VULHUB ™

Bloginator是一套PHP脚本，允许用户在网站上显示、添加、编辑和删除文章。 Bloginator没有正确地验证认证cookie，远程攻击者可以通过修改identifyYourself cookie参数绕过安全限制获得非授权访问。以下是有漏洞的代码段： [URL] www.site.com/bloginator/articleCall.php global $name,$password,$returnLink; $p_name = strip_tags(substr($_POST['name'],0,32)); $p_password = strip_tags(substr($_POST['password'],0,32)); if(crypt($p_name , $name) == $name and crypt($p_password,$password) == $password ) { setcookie("identifyYourself","you are identified"); print "Login successfull "; print $returnLink; } else {print "Wrong username or password"; } }

Bloginator是一套PHP脚本，允许用户在网站上显示、添加、编辑和删除文章。 Bloginator没有正确地验证认证cookie，远程攻击者可以通过修改identifyYourself cookie参数绕过安全限制获得非授权访问。以下是有漏洞的代码段： [URL] www.site.com/bloginator/articleCall.php global $name,$password,$returnLink; $p_name = strip_tags(substr($_POST['name'],0,32)); $p_password = strip_tags(substr($_POST['password'],0,32)); if(crypt($p_name , $name) == $name and crypt($p_password,$password) == $password ) { setcookie("identifyYourself","you are identified"); print "Login successfull "; print $returnLink; } else {print "Wrong username or password"; } }