Description
delcookie.php in Professional Home Page Tools Guestbook changes the expiration date of a cookie instead of deleting the cookie's value, which makes it easier for attackers to steal the cookie and obtain the administrator's password hash after logout.
References
- 1275 third-party-advisory
- http://artemis.abenteuer-mittelerde.de/pub/adv02-phptgb.txt
- 20060717 Professional PHP Tools Guestbook Multiple Vulnerabilities mailing-list
- phptguestbook-setcookie-insecure-cookie(27775) vdb-entry
- 21102 third-party-advisory