AOH :: HP Unsorted I :: TB10871.HTM

ifdate 2.* unauthorized administrative access bug



ifdate 2.* unauthorized administrative access bug
ifdate 2.* unauthorized administrative access bug



ifdate 2.* unauthorized administrative access bug

vendor : Liz0zim
web: www.biyosecurity.net www.expw0rm.com 


Script Home Page : http://www.ifusionservices.co.uk/ 
vul. version : iFdate 2.*

vul code :

all admin folder files 

///////////////////////////////////////
// Checks user is logged in          //
///////////////////////////////////////
if (($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){
} else {
echo  ""; -------> Vul code 
}

script coder don't write exit(); or die(); 


open web browser setting disable javascript 


http://victim.com/[path]/admin/ :=) i am new admin 

-------------------------------------


fix:


///////////////////////////////////////
// Checks user is logged in          //
///////////////////////////////////////
if (($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){
} else {
echo  ""; 
exit(); //add code
}


Orginal: http://www.expw0rm.com/ifdate-2-unauthorized-administrative-access-bug_no285.html 

// Exploit Worm www.expw0rm.com 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.