43 lines
No EOL
1.5 KiB
Text
43 lines
No EOL
1.5 KiB
Text
--==+================================================================================+==--
|
|
--==+ PhShoutBox <= 1.5 (final) Insecure Cookie Handling (Arbitrary Authentication) +==--
|
|
--==+================================================================================+==--
|
|
|
|
|
|
|
|
Discovered By: t0pP8uZz
|
|
Discovered On: 18 April 2008
|
|
Script Download: http://phphq.net/scripts.php?p=free-scripts&id=2
|
|
DORK: inurl:"phshoutbox.php"
|
|
|
|
Vendor Has Not Been Notified!
|
|
|
|
|
|
DESCRIPTION:
|
|
PhShoutBox suffers from insecure cookie handling, allowing the remote attacker to craft a cookie that
|
|
makes the attacker look like a admin, this works because the admin panel only checks the password
|
|
if a password has been posted using the php vars "$_POST" if POST isnt set, then the cookies will be checked
|
|
for existance if they exist then it will grant admin.
|
|
|
|
the javascript code below is the easyiesy way to do this, just paste it in your browser whilst
|
|
at the vulnerable site, then visit "admin.php"
|
|
|
|
|
|
Vulnerability:
|
|
version 1.5: javascript:document.cookie = "phadmin=True; path=/;";
|
|
version < 1.4: javascript:document.cookie = "ssbadmin=True; path=/;";
|
|
|
|
|
|
NOTE/TIP:
|
|
admin login is at "/admin.php" on 1.5 final
|
|
and at "/shoutadmin.php" on 1.4 & below
|
|
|
|
|
|
GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !
|
|
|
|
|
|
|
|
--==+================================================================================+==--
|
|
--==+ PhShoutBox <= 1.5 (final) Insecure Cookie Handling (Arbitrary Authentication) +==--
|
|
--==+================================================================================+==--
|
|
|
|
# milw0rm.com [2008-04-18] |