This exploit demonstrates an insecure cookie handling vulnerability in H2O-CMS <= 3.4, allowing an attacker to set an 'admin' cookie via JavaScript to bypass authentication.
Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target:H2O-CMS <= 3.4
No auth needed
Prerequisites:Victim must execute the provided JavaScript code