Web Slider - exploit.company

vendor:

Web Slider

by:

t0pP8uZz

7.5

CVSS

HIGH

Insecure Cookie/Authentication Handling

287

CWE

Product Name: Web Slider

Affected Version From: 0.1

Affected Version To: 0.6

Patch Exists: NO

Related CWE:

CPE: a:webslider_project:webslider:0.6

Metasploit:

Other Scripts:

Platforms Tested:

2008

Web Slider <= 0.6 Insecure Cookie/Authentication Handling

The Web Slider script version 0.6 and prior suffers from insecure cookie handling. When an admin logs in successfully, a cookie is created without containing any password or other authentication data. By creating a specific cookie, an attacker can impersonate an admin and gain unauthorized access to restricted areas.

Mitigation:

The vendor has not been notified. To mitigate this vulnerability, it is recommended to update to a patched version or discontinue the use of the Web Slider script.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+		 Web Slider <= 0.6 Insecure Cookie/Authentication Handling	     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 15 MAY 2008
Script Download: http://sourceforge.net/projects/webslider/
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION:

Web Slider 1.6 (and prior), suffers from insecure cookie handling, when a admin logs in successfully a
cookie is created so admin doesnt have to login everypage, the bad thing is the coding is poor and the script
only checks to see if the cookie exists, it doesnt contain any password or anything.

so all we need to do is create a cookie so it makes us look like admin, the below javascript will do just that.



Exploit:

javascript:document.cookie = "admin=1; path=/";



NOTE/TIP: 

after pasting the above javascript code in your browser on a affected domain, you will be able to goto
"/admin.php" and access it as if you were a admin.

this should come to your attention how many web-developers are very bad coders. and leave massive
easy-to-fix holes like this in there scripts.

just remember when downloading a file of any kind to read through its source, and make sure its secure



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+		 Web Slider <= 0.6 Insecure Cookie/Authentication Handling	     +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-15]