COMMAND
IndexU
SYSTEMS AFFECTED
IndexU all versions prior to 2.0Beta (2.0Beta included)
PROBLEM
'Sp4rK' (Undersec Security Advisory) found following. INDEXU is
a content management system software that aims to help a web
master to build a portal in just seconds. It is based in PHP code
and uses MySQL as its database. INDEXU uses a web frontend to
manage every thing.
INDEXU uses a web frontend to manage every database it uses. The
admin section is located in /admin. When you login there it asks
for a user name and password (defaults to admin/admin). Once you
log in it sets a cookie with the following format:
host.where.indexu.is.installed TRUE / FALSE 1388494785 cookie_admin_authenticated 1
This cookie will (or should be) deleted when the current session
finis hes, and is used to determine whether you are an admin or
not.
Anybody who can manipulate it's cookie settings is able to act as
if he/she was the admin.
SOLUTION
Use .htaccess authentication to prevent users from accessing
adminitrator area. The bug hasn't been fixed yet, but we hope
it'll be fixed in the next release of INDEXU.