Informations :
°°°°°°°°°°°°°°
Language : PHP
Website : http://www.aldweb.com/
Version : 1.9, 2.0, 2.1, 2.2 (and less ?)
Problem : Admin Access

PHP Code/Location :
°°°°°°°°°°°°°°°°°°°

admin/admin.php :

------------------------------------------------------------------------
-----------------------------------------------------
[...]
$portalname = "miniPortailAdmin";
$cookiedata = "adminok";
include("mdp.php");

if (md5($pass) == $mdp) {
setcookie($portalname, $cookiedata);
}
elseif ($logout == 1) {
setcookie($portalname, "");
header("location:../index.php");
}

$chemin = "../";
include($chemin."inc/includes.inc");

if (($HTTP_COOKIE_VARS[$portalname] == $cookiedata || md5($pass) == $mdp) &&
empty($pg)) {
include($chemin."inc/hpage.inc");
htable($admin1, "100%");

[...]

}
elseif ($HTTP_COOKIE_VARS[$portalname] == $cookiedata && !empty($pg)) {
if (file_exists("inc/".$pg.".inc")) {
$chemin = "../";
include("inc/".$pg.".inc");
}
[...]
------------------------------------------------------------------------
-----------------------------------------------------

Exploit :
°°°°°°°
Set a cookie named miniPortailAdmin with for value "adminok" on
http://[target]/admin/admin.php

Solution :
°°°°°°°°°

A patch has been created and can be found on http://www.phpsecure.info .

In admin/admin.php, replace the lines :
------------------------------------------------------------------------
-------------------
[...]
$portalname = "miniPortailAdmin";
$cookiedata = "adminok";
include("mdp.php");

if (md5($pass) == $mdp) {
setcookie($portalname, $cookiedata);
}
elseif ($logout == 1) {
setcookie($portalname, "");
header("location:../index.php");
}

$chemin = "../";
include($chemin."inc/includes.inc");

if (($HTTP_COOKIE_VARS[$portalname] == $cookiedata || md5($pass) == $mdp) &&
empty($pg)) {
[...]
------------------------------------------------------------------------
-------------------

by :

------------------------------------------------------------------------
---------------
include("mdp.php");
session_start();
$miniPortailAdmin = "";

if (md5($pass) == $mdp) {
$miniPortailAdmin = "adminok";
session_register("miniPortailAdmin");
}
elseif ($logout == 1) {
session_unregister("miniPortailAdmin");
header("location:../index.php");
}

$chemin = "../";
include($chemin."inc/includes.inc");

if ((session_is_registered("miniPortailAdmin") || md5($pass) == $mdp) &&
empty($pg)) {
------------------------------------------------------------------------
---------------

and the line :

------------------------------------------------------------------------

elseif ($HTTP_COOKIE_VARS[$portalname] == $cookiedata && !empty($pg)) {
------------------------------------------------------------------------

by :

--------------------------------------------------------------------
elseif (session_is_registered("miniPortailAdmin") && !empty($pg)) {
--------------------------------------------------------------------

More Details :
°°°°°°°°°°°°
In French :
http://www.frog-man.org/tutos/miniPortail.txt

frog-m@n

_________________________________________________________________
MSN Search, le moteur de recherche qui pense comme vous !
http://search.fr.msn.be

[ reply ]