vendor:
Online Email Manager
by:
Hussin X
8,8
CVSS
HIGH
Insecure Cookie Handling
613
CWE
Product Name: Online Email Manager
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Online Email Manager Insecure Cookie Handling Vulnerability
A vulnerability in Online Email Manager allows an attacker to gain access to the admin page by setting the auth cookie to admin. This can be done by using the javascript command document.cookie = "auth=admin; path=/". The attacker can then access the emailList.php page and gain access to the admin page.
Mitigation:
Ensure that cookies are properly validated and that the application is not vulnerable to cookie manipulation.
