vendor:
FreeWebshop
by:
k1tk4t
7.5
CVSS
HIGH
Cookie Injection
352
CWE
Product Name: FreeWebshop
Affected Version From: <= 2.2.7
Affected Version To: <= 2.2.7
Patch Exists: NO
Related CWE:
CPE: a:freewebshop:freewebshop:2.2.7
Platforms Tested:
2007
FreeWebshop <= 2.2.7 - (cookie) Admin Password Grabber Exploit
This exploit allows an attacker to grab the admin username and password from FreeWebshop version 2.2.7 or below. The attacker needs to provide the target URL and path as command line arguments. The exploit uses LWP::UserAgent and HTTP::Cookies modules to inject a cookie and retrieve the admin credentials.
Mitigation:
Upgrade to a newer version of FreeWebshop that has fixed this vulnerability. Ensure that input validation and sanitization is implemented to prevent cookie injection attacks.
