PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication)

vendor:

PostCard

by:

t0pP8uZz

7.5

CVSS

HIGH

Insecure Cookie Handling

613

CWE

Product Name: PostCard

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication)

PostCard 1.0 (and prior???) suffers from insecure cookie handling. To be able to view admin panel the user requires to login using a valid user/pass. After the valid user/pass has been passed and matches then a cookie is created. The admin panel checks to see if this cookie exists. If it does then user can access admin. Since the cookie doesn't contain no hash/pass/sid just a number '1' indicating we are logged in, the remote attacker can craft a cookie (working example below) to access admin.

Mitigation:

Ensure that cookies are properly hashed and salted before being stored on the server.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+        PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication)	     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 13 April 2008
Script Download: N/A
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION:
PostCard 1.0 (and prior???) suffers from insecure cookie handling.
to be able to view admin panel the user requires to login using a valid user/pass
after the valid user/pass has been passed and matches then a cookie is created 
the admin panel checks to see if this cookie exists  if it does then user can access admin.

since the cookie doesnt contain no hash/pass/sid just a number "1" indicating we are logged in, the remote
attacker can craft a cookie (working example below) to access admin
 


Vulnerability:
javascript:document.cookie = "logged_in=1; path=/;";


NOTE/TIP:
after running the above javascript (or adding cookies manually) you will be able to visit the admin panel at
"/postcard-admin.php" 


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+        PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication)	     +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-13]