lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <b3a0e1f9-d0d8-5441-33b1-84d748347021@kkoenig.net> Date: Mon, 23 Apr 2018 06:41:09 +0200 From: Karsten König <mail@...enig.net> To: oss-security@...ts.openwall.com, fulldisclosure@...lists.org Subject: [FD] Authorization bypass in PHPLiteAdmin since 1.9.5 Hello, I found a small issue in PHPLiteAdmin. It's an authorization bypass which works since version 1.9.5 from 2014 (current is 1.9.7.1) because PLA uses '==' instead of '===' for the password comparison in 'attemptGrant' of the 'Authorization' class. If the password is set to one which correspondends to a number in scientific notation, one could easier bruteforce the password or bypass it completely, e.g.: php > var_dump('200' == '2e2'); bool(true) php > var_dump('0' == '0e2'); bool(true) php > var_dump('0' == '0e2342'); bool(true) I opened an issue at GitHub for this[0] and have written about it[1] (section 2 is the interesting one for this issue). Best, Karsten [0] https://github.com/phpLiteAdmin/pla/issues/11 [1] http://k3research.outerhaven.de/posts/small-mistakes-lead-to-big-problems.html _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists