vendor:
PHP-Post
by:
Farhad Koosha
7,5
CVSS
HIGH
Privilege Escalation
264
CWE
Product Name: PHP-Post
Affected Version From: 0.21
Affected Version To: 1.0
Patch Exists: YES
Related CWE: N/A
CPE: a:php-post:php-post
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
[KAPDA::#52] – PHP-Post 1.0 Cookie Modification Privilege Escalation Vulnerability
PHP-Post contains a flaw that may allow a remote attacker to gain administrative privileges. PHP-Post doesn't properly authenticate remote users if auto login is on! By editing the values of the cookie, an attacker can change their privilege from a regular user to administrator and submit it back to the site.
Mitigation:
Ensure that the authentication process is properly implemented and that the cookie values are properly validated.
