PHPBlogger cookie privilege escalation Jul 28 2007 11:03AM
darthballsbr hotmail com
PHPBlogger is a simple tool to help the creation of web blogs...

Encrypted admin password and other preferences are stored on /data/pref.db

You can find lots of them exposed with google
search: pref password= filetype:db


The admin panel is acessible once you have a cookie named "key" with the encrypted password

So, its possible to administrate remote blogs just by searching for a exposed pref.db and creating a cookie for the page with the encrypted password

for more detailes (pt-BR)

by darthballs

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus