bugtraq - Re: SMF .htaccess bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 06 Nov 2007 13:39:34 -0500
From: "Matt D. Harris" <mdh@...itox.net>
To: bugtraq@...urityfocus.com
Subject: Re: SMF .htaccess bypass

So what you're saying is that .htaccess is working as expected.  What 
does this have to do with SMForum?  Using .htaccess to protect the admin 
section is not at all standard in SMForum, so I'm not really sure how or 
why this is relevant.  Furthermore, SMForum still has its own 
authentication mechanisms.  This doesn't seem like a bug/issue at all, 
just software working as intended, even if someone chooses to use it in 
an unusual and insecure manner.
- mdh

h3llcode@...mail.it wrote:
> # ./start
> #
> # Discovered by Seph1roth on June 2007 (was priv8)
> #
> # Vulnerable: Simple Machine Forum [ALL Versions]
> #
> # Visit: http://www.blackroots.it - Best hacking site.
> #
> # Description:
> 
> If smf has index.php?action=admin in .htaccess ,i can bypass that by typing in the url some variable of administration panel :
> 
> example:
> 
> index.php?action=admin (.htaccess,then access denied)
> index.php?action=membergroups (accessible)
> index.php?action=news (accessible)
> index.php?action=featuresettings (accessible)
> 
> ...and others...
> 
> i can bypass and enter the administration by typing the accessible variables in the url...
> 
> # Greets to all BlackRoots Users
> #
> # Shoutz to all kiddies
> #
> # ./end
> 

-- 
/*
  * mdh - Solitox Networks (Lead Project Engineer)
  * Facts often matter little, in the face of fervently held perceptions
  */