CVE-2020-8510; Insecure Access Control Within phpABook

CVE-2020-8510 phpABook 0.9 intermediate Auth Bypass

---

Within the phpABook(v0.9i) software, upon authentication a cookie with the name “userInfo” is set in your browser with the format of user+perms+lang(Ex. Admin+1+en). However any attacker is able to set this cookie and gain administrative access to the software from any user. In order to perform this attack you need to add a cookie to a browser with the name of “userInfo” and the value of admin+1+en (this is possible through Chrome Dev Tools -> Application -> Cookies, or adding the cookie into a burp request, or through one of the many chrome plugins available.