dB Masters Multimedia Link Directory Cookie Authentication Bypass Vulnerability

Bugtraq ID:	37517
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 29 2009 12:00AM
Updated:	Dec 30 2009 08:22PM
Credit:	indoushka
Vulnerable:	dB Masters Multimedia Links Directory 3.1.3
Not Vulnerable:

dB Masters Multimedia Link Directory Cookie Authentication Bypass Vulnerability

dB Masters Multimedia Link Directory is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

dB Masters Multimedia Link Directory Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following example data is available:

javascript:document.cookie="admin_log=in;path=/";

dB Masters Multimedia Link Directory Cookie Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

dB Masters Multimedia Link Directory Cookie Authentication Bypass Vulnerability

References:

• Vendor Homepage (db Masters Multimedia)