Exploits / Vulnerability Discovered : 2023-04-03 |
Type : webapps |
Platform : php
This exploit / vulnerability Pimcore v5.4.18skeleton sensitive cookie with improper samesite attribute is for educational purposes only and if it is used you will do on your own risk!
## Description:
The pimCore-5.4.18-skeleton suffers from Sensitive Cookie with
Improper SameSite Attribute vulnerability - PHPSESSID cookie Session
management connection requests are not sanitizing correctly.
There are no securing changes in PHPSESSID cookies for every request -
validating sessions and changing a cookie for every connection - POST
Request.
The attacker in the same network can trick the user - the
administrator of this system and can steal his cookie,
then he can make very evil things by using the same session from the
name of the already authenticated user - administrator, on a couple of
PCs with different IPs which are used from different machines into
that network.
When the attacker steals the cookie, he can manipulate the same
session, for example, he can log out or do very malicious stuff.
This is a very stupid developer's error, and this can be very
dangerous for the owner of the system.
The attack is possible also in the external network!
## STATUS: HIGH Vulnerability
[+] Payload:
```Python
#!/usr/bin/python3
# @nu11secur1ty 2023
import time
from selenium import webdriver
driver = webdriver.Chrome()
print("Give the stolen cookie...\n")
cookie = input()
print("Give the domain or IP of the owner of the cookie...\n")
target = input()