PT-2012-53: Privilege Gaining in DataLife Engine
Version: 9.7 and earlier
Severity level: Medium
Impact: Privilege gaining
Access Vector: Remote
Base Score: 6.8
CVE: not assigned
DataLife Engine is a website management system.
Positive Technologies experts have detected a session management vulnerability that allows attackers to conduct Session Fixation attack in DataLife Engine.
Session cookies are not discarded that allows attackers to conduct the attack. The attacker with access to evil.host.ru sub domain (or using Cross-Site Scripting) is able to set Cookie: PHPSESSID=123; domain=.host.ru in user's browser and as logged in to dle.host.ru, the user can use 123 session that now has privileges of the authorized user.
How to fix
Update your software up to the latest version.
30.10.2012 - Vendor is notified
30.10.2012 - Vendor gets vulnerability details
19.01.2013 - Vendor releases fixed version and details
04.02.2013 - Public disclosure
The vulnerability has discovered by Timur Yunusov, Positive Research Center (Positive Technologies Company)
Reports on the vulnerabilities previously discovered by Positive Research: