Newbie CMS Insecure Cookie Authentication Bypass Vulnerability

Bugtraq ID:	38421
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2010 12:00AM
Updated:	Feb 25 2010 12:00AM
Credit:	JIKO
Vulnerable:	Newbie CMS Newbie CMS 0.02
Not Vulnerable:	Newbie CMS Newbie CMS 0.03

Newbie CMS Insecure Cookie Authentication Bypass Vulnerability

Newbie CMS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

Versions prior to Newbie CMS 0.03 are vulnerable; other versions may also be affected.

Newbie CMS Insecure Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

Supplying the following cookie data is sufficient to exploit this issue:

javascript:document.cookie="nb_logged=jiko;path=/newbb/admin/";

Newbie CMS Insecure Cookie Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.


Newbie CMS Newbie CMS 0.02

• Newbie CMS newbiev003.zip
  http://newbie-cms.com/free_download.php?file=newbiev003.zip

Newbie CMS Insecure Cookie Authentication Bypass Vulnerability

References:

• New version released - V.03 (Newbie CMS)
  
• Newbie CMS Homepage (Newbie CMS)