bugtraq - CMS.R. the Content Management System admin authentication baypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060911153827.20299.qmail@securityfocus.com>
Date: 11 Sep 2006 15:38:27 -0000
From: security@...or.net
To: bugtraq@...urityfocus.com
Subject: CMS.R. the Content Management System admin authentication baypass

Hello

Title : CMS.R. the Content Management System admin authentication baypass
Discovered by : HACKERS PAL
Copyrights : HACKERS PAL
Website : WwW.SoQoR.NeT
Email : security@...or.net

The Vulnerability works 100% with magic_quotes_gpc = off

put the user name value (' or 1=1/*)

[code]
' or 1=1/*
[/code]

and you will login :)

error file : index.php
line : 48

query :-
[code]
       $query = "SELECT * From ".$config->get("TABLE_USER")." where BINARY username='".$_POST['adminname']."' AND BINARY pass='".$_POST['adminpass']."'";
[/code]
solution:-

replace
[code]
        $query = "SELECT * From ".$config->get("TABLE_USER")." where BINARY username='".$_POST['adminname']."' AND BINARY pass='".$_POST['adminpass']."'";
[/code]

with
[code]
//
//	Fixed By : HACKERS PAL
//                        WwW.SoQoR.NeT
//
       $query = "SELECT * From ".$config->get("TABLE_USER")." where BINARY username='".addslashes($_POST['adminname'])."' AND BINARY pass='".addslashes($_POST['adminpass'])."'";
[/code]

WwW.SoQoR.NeT