Multiple Products Cookie Authentication Bypass Vulnerability

Bugtraq ID:	55234
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 27 2012 12:00AM
Updated:	Aug 30 2012 06:40AM
Credit:	Mattijs van Ommeren from Alcyon Security.
Vulnerable:
Not Vulnerable:

Multiple Products Cookie Authentication Bypass Vulnerability

Multiple products including Conceptronic and Sitecom are prone to an authentication-bypass vulnerability because they fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application.

Multiple Products Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue through a browser.

The following example data is available:

• /data/vulnerabilities/exploits/55234.txt

Multiple Products Cookie Authentication Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Multiple Products Cookie Authentication Bypass Vulnerability

References:

• Conceptronic Home Page (Conceptronic)
  
• Sitecom Homepage (Sitecom)