lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070513210702.4277.qmail@securityfocus.com> Date: 13 May 2007 21:07:02 -0000 From: expw0rm@...il.com To: bugtraq@...urityfocus.com Subject: ifdate 2.* unauthorized administrative access bug ifdate 2.* unauthorized administrative access bug vendor : Liz0zim web: www.biyosecurity.net www.expw0rm.com Script Home Page : http://www.ifusionservices.co.uk/ vul. version : iFdate 2.* vul code : all admin folder files /////////////////////////////////////// // Checks user is logged in // /////////////////////////////////////// if (($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){ } else { echo "<script>document.location.href='admin_login.php'</script>"; -------> Vul code } script coder don't write exit(); or die(); open web browser setting disable javascript http://victim.com/[path]/admin/ :=) i am new admin ------------------------------------- fix: /////////////////////////////////////// // Checks user is logged in // /////////////////////////////////////// if (($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){ } else { echo "<script>document.location.href='admin_login.php'</script>"; exit(); //add code } Orginal: http://www.expw0rm.com/ifdate-2-unauthorized-administrative-access-bug_no285.html // Exploit Worm www.expw0rm.com