Acc Scripts Real Estate and Statistics Cookie Authentication Bypass Vulnerability

Bugtraq ID:	32078
Class:	Access Validation Error
CVE:	CVE-2008-6294 CVE-2008-6293
Remote:	Yes
Local:	No
Published:	Nov 03 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	Hakxer
Vulnerable:	Acc Scripts Acc Statistics 1.1 Acc Scripts Acc Real Estate 4.0
Not Vulnerable:

Acc Scripts Real Estate and Statistics Cookie Authentication Bypass Vulnerability

Acc Real Estate and Acc Statistics are prone to an authentication-bypass vulnerability because they fail to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

Acc Statistics 1.1 and Acc Real Estate 4.0 are vulnerable; other versions may also be affected.

Acc Scripts Real Estate and Statistics Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following example code is available:

javascript:document.cookie="username_cookie=admin

Acc Scripts Real Estate and Statistics Cookie Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Acc Scripts Real Estate and Statistics Cookie Authentication Bypass Vulnerability

References:

• Vendor Homepage (Acc Scripts)