bugtraq - Get admin level on Goldlink script v3.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 18 Oct 2003 03:45:49 +0200
From: "Weke" <weke@...gramas-hacker.com>
To: <bugtraq@...urityfocus.com>
Subject: Get admin level on Goldlink script v3.0

There is a bug in script of links Goldlink v3.0
(http://www.goldscripts.com/goldlink.php). You can access to panel with
admin privileges. The bug is in variables.php file:

function Acceso() {
  global $extension;
  global $tb_admin;
  global $HTTP_COOKIE_VARS;
  $vadmin_login=$HTTP_COOKIE_VARS["vadmin_login"];
  $vadmin_pass=$HTTP_COOKIE_VARS["vadmin_pass"];
  $link=Conectarse();
  if (!(isset($vadmin_login) && isset($vadmin_pass))) {
    if (mysql_query("select * from $tb_admin where Login='$vadmin_login' &&
Password='$vadmin_pass'",$link)) {
      mysql_close($link);
      header("Location: index.$extension");
      exit();
    }
  }
}

The bug is in $vadmin_login and $vadmin_pass proccesing. One idea is set:

vadmin_login = ' OR Login LIKE '%

and

vadmin_pass = ' OR Password LIKE '%

If you create two cookies with thoses values and go to:
http://www.victim.com/godllink/admin/admin.php you will go to goldlink panel
with level admin, and you will be able to modify links, users passwords,
admin password, etc.  For fix it add the two lines before 'if
(!(isset($vadmin_login) && isset($vadmin_pass))) {' in variables.php file :

$vadmin_login = addslashes($vadmin_login);
$vadmin_pass = addslashes($vadmin_pass);

Weke
http://www.programas-hacker.com