CVE-2004-0249

PHPX 2.0-3.2.4 - Unauthenticated Account Access via Cookie Manipulation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-0249. PoCs published by Manuel L?pez.

AI-analyzed exploit summary This PoC exploits an account hijacking vulnerability in PHPX 3.2.4 by sending a crafted cookie (PXL=2) to bypass authentication. It demonstrates how an attacker can gain unauthorized access by manipulating session cookies.

Description

PHPX 2.0 through 3.2.4 allows remote attackers to gain access to other accounts by modifying the cookie's PXL variable to reference another userID.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Manuel L?pez · phpwebappsphp

https://www.exploit-db.com/exploits/23644

View Code ZIP pw:eip

This PoC exploits an account hijacking vulnerability in PHPX 3.2.4 by sending a crafted cookie (PXL=2) to bypass authentication. It demonstrates how an attacker can gain unauthorized access by manipulating session cookies.

Classification

Working Poc 90%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: PHPX 3.2.4

No auth needed

Prerequisites: Network access to the target PHPX instance · PHPX 3.2.4 or earlier installed

MITRE ATT&CK