vendor:
ClickBank Directory
by:
TiGeR-Dz
7,5
CVSS
HIGH
Insecure Cookie Handling
614
CWE
Product Name: ClickBank Directory
Affected Version From: 1.0.1
Affected Version To: 1.0.1
Patch Exists: NO
Related CWE: N/A
CPE: a:mrcgiguy:clickbank_directory
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
ClickBank Directory Version 1.0.1 Insecure Cookie Handling Vulnerability
A vulnerability exists in ClickBank Directory Version 1.0.1 which allows an attacker to set an insecure cookie to gain access to the admin panel. The exploit code is 'javascript:document.cookie="clickbank=Logged+In;path=/";' and the vulnerable URL is 'http://www.mrcgiguy.com/clickbank/admin.php'.
Mitigation:
Ensure that all cookies are set with the secure flag and that all cookies are set with the httpOnly flag.
