Omegasoft Insel Authentication Bypass Vulnerability and User Enumeration Weakness

Bugtraq ID:	27210
Class:	Unknown
CVE:	CVE-2008-1135 CVE-2008-1134
Remote:	Yes
Local:	No
Published:	Jan 09 2008 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	MC.Iglo is credited with the discovery of these issues.
Vulnerable:	Omegasoft Insel 7
Not Vulnerable:

Omegasoft Insel Authentication Bypass Vulnerability and User Enumeration Weakness

An attacker can use a browser to exploit these issues.

The following sample cookie data is available:

Cookiename: OMEGALogon
value:[MANDATOR]%7C[CUSTOMERNUMBER]%7C[USERID]%7C%7CArial%7CArial%7C%2D%2D%2D%2D%2D%2D%7C[SURNAME]%2C+[NAME]%7C%7C%7C[LASTLOGINTIME]%7C

Cookiename: OMEGA[MANDATOR]
value: [USERID]%7C[CUSTOMERNUMBER]%7[HOST]%7C[DATE]%7C

Omegasoft Insel Authentication Bypass Vulnerability and User Enumeration Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Omegasoft Insel Authentication Bypass Vulnerability and User Enumeration Weakness

References:

• Omegasoft Insel Homepage (Omegasoft )
  
• Privilege escalation in Omegasoft Insel 7 ('MC Iglo' )