CVE-2020-8510; Insecure Access Control Within phpABook

Posted Jan 31, 2020

By Emma Ruby

1 min read

CVE-2020-8510 phpABook 0.9 intermediate Auth Bypass

Within the phpABook(v0.9i) software, upon authentication a cookie with the name “userInfo” is set in your browser with the format of user+perms+lang(Ex. Admin+1+en). However any attacker is able to set this cookie and gain administrative access to the software from any user. In order to perform this attack you need to add a cookie to a browser with the name of “userInfo” and the value of admin+1+en (this is possible through Chrome Dev Tools -> Application -> Cookies, or adding the cookie into a burp request, or through one of the many chrome plugins available.

CVE

This post is licensed under CC BY 4.0 by the author.