bugtraq - Virginity Security Advisory 2003-001 : Hola CMS - Admin Password Disclosure by Include vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030813222606.31442.qmail@www.securityfocus.com>
Date: 13 Aug 2003 22:26:06 -0000
From: Virginity Security <advisory@...fiweb.de>
To: bugtraq@...urityfocus.com
Subject: Virginity Security Advisory 2003-001 : Hola CMS - Admin Password
    Disclosure by Include vulnerability

- - - --------------------------------------------------------------------
Virginity Security Advisory 2003-001
- - - --------------------------------------------------------------------
             DATE : 2003-08-13 03:11 GMT
             TYPE : remote
VERSIONS AFFECTED : <== hola-cms-1.2.9-10 (http://holacms.drunkencat.net/)
           AUTHOR : Virginity
- - - --------------------------------------------------------------------

Description:

I found a security bug in Hola CMS with which you can get the admin 
password.
The bug is in the htmltags.php - the file was written to edit an internal 
file.
The Problem is htmltags.php doesn't check if you are
logged in as administrator so you can include the unprotected passwordfile
and htmltags.php shows the password file which you can edit freely or just
steal the password to gain possible acces to the whole server.

Author of the Software has been notified.

- - - --------------------------------------------------------------------

Example:
http://www.targetexample.com/path_of_hola/admin/cms/htmltags.php?
datei=./sec/data.php

shows you the username and password of the administrator!

- - - --------------------------------------------------------------------

Solution:

Put the following code at the beginning of htmltags.php

<?
 include_once('./sec/data.php');
 include_once('./sec/auth.php');
?>

- - - --------------------------------------------------------------------