Authentication Bypass via Forgery of remember-me cookies allowing Admin Takeover

Vulnerability Overview Title: Authentication Bypass: Forgeable remember-me cookies (cookie name/cookieID) allowing unauthenticated administrators to take over #2 Summary: The application authenticates users via two plain-text cookies (cookie name and cookieID). The value of is loosely compared (==) against the column in the database, and is not a protected key. Newly registered users always receive a of '0', and the default administrator account in also has a fixed of '0'. Any unauthenticated visitor can set these two cookies to become an administrator or take over any registered account. Affected Versions: Commit: #209e638e14657999afec9912302d2a12449 (master) Vulnerability Type: Authentication Bypass (CWE-287 / CWE-565), relying on cookies without verification and integrity checks for security decisions Affected Code: - Session::checkLogin() (lines 87-118) - MySQLDB::confirmUserID() (lines 94-109), MySQLDB::addNewUser() (lines 142-152) - Seeded user row Root Cause: 1. trusts the raw cookie name/cookieID values and successfully calls as a complete login, including for administrator accounts. 2. uses PHP loose comparison (==) to compare with the stored value, lacking session binding, expiration, or entropy requirements. 3. The stored value is predictable or public: writes the constant string '0' for each new user, and the administrator row is seeded by (documented default configuration) with a of '0', visible to anyone reading the repository. An attacker who knows or guesses a valid (username, userid) pair can forge the cookies and log in without credentials. Impact Scope Full Authentication Bypass: No username/password required. Full Administrator Takeover on Any Installation: Based on default configurations created from , since the administrator userid is a public constant. Takeover of Every Newly Registered User (userid '0') and Any Account with userid NULL (loose == treats null values as equal). From the administrator account, the attacker can read all exams, modify/delete questions, users, and results (/admin/adminprocess.php), and access leaked administrator data endpoints. CVSS Score (Self-Assessment): CVSS 3.1: 9.8 Critical - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Network attack vector, low complexity, no privileges or user interaction required, bypass grants the attacker full administrator-level impact on confidentiality, integrity, and availability. Remediation 1. Use Strong Hashing and Salts: Ensure is generated using strong hashing algorithms (e.g., SHA-256) and random salts, avoiding fixed values. 2. Session Binding: Bind to the user session, ensuring a new is generated for each session. 3. Strict Comparison: Use strict comparison (===) instead of loose comparison (==) to prevent vulnerabilities caused by type coercion. 4. Validate Cookies: Validate the integrity and validity of cookies on the server side to ensure cookies have not been tampered with. 5. Regularly Update Default Settings: Avoid using public default s; regularly update the of default administrator accounts. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Authentication Bypass via Forgery of remember-me cookies allowing Admin Takeover

More from this source