Web Scribble Solutions webClassifieds Insecure Cookie Authentication Bypass Vulnerability

Bugtraq ID:	34622
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 20 2009 12:00AM
Updated:	Apr 22 2009 06:26PM
Credit:	ThE g0bL!N
Vulnerable:	Web Scribble Solutions webClassifieds 0
Not Vulnerable:

Web Scribble Solutions webClassifieds Insecure Cookie Authentication Bypass Vulnerability

Web Scribble Solutions webClassifieds is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

Web Scribble Solutions webClassifieds Insecure Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

Supplying the following cookie data is sufficient to exploit this issue:

javascript:document.cookie="sAuth=[id];path=/";

Web Scribble Solutions webClassifieds Insecure Cookie Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Web Scribble Solutions webClassifieds Insecure Cookie Authentication Bypass Vulnerability

References:

• webClassifieds Homepage (Web Scribble Solutions)