BugTraq
Back to list
|
Post reply
Virginity Security Advisory 2003-001 : Hola CMS - Admin Password Disclosure by Include vulnerability
Aug 13 2003 10:26PM
Virginity Security (advisory konfiweb de)
- - - --------------------------------------------------------------------
Virginity Security Advisory 2003-001
- - - --------------------------------------------------------------------
DATE : 2003-08-13 03:11 GMT
TYPE : remote
VERSIONS AFFECTED : <== hola-cms-1.2.9-10 (http://holacms.drunkencat.net/)
AUTHOR : Virginity
- - - --------------------------------------------------------------------
Description:
I found a security bug in Hola CMS with which you can get the admin
password.
The bug is in the htmltags.php - the file was written to edit an internal
file.
The Problem is htmltags.php doesn't check if you are
logged in as administrator so you can include the unprotected passwordfile
and htmltags.php shows the password file which you can edit freely or just
steal the password to gain possible acces to the whole server.
Author of the Software has been notified.
- - - --------------------------------------------------------------------
Example:
http://www.targetexample.com/path_of_hola/admin/cms/htmltags.php?
datei=./sec/data.php
shows you the username and password of the administrator!
- - - --------------------------------------------------------------------
Solution:
Put the following code at the beginning of htmltags.php
<?
include_once('./sec/data.php');
include_once('./sec/auth.php');
?>
- - - --------------------------------------------------------------------
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
- - - --------------------------------------------------------------------
Virginity Security Advisory 2003-001
- - - --------------------------------------------------------------------
DATE : 2003-08-13 03:11 GMT
TYPE : remote
VERSIONS AFFECTED : <== hola-cms-1.2.9-10 (http://holacms.drunkencat.net/)
AUTHOR : Virginity
- - - --------------------------------------------------------------------
Description:
I found a security bug in Hola CMS with which you can get the admin
password.
The bug is in the htmltags.php - the file was written to edit an internal
file.
The Problem is htmltags.php doesn't check if you are
logged in as administrator so you can include the unprotected passwordfile
and htmltags.php shows the password file which you can edit freely or just
steal the password to gain possible acces to the whole server.
Author of the Software has been notified.
- - - --------------------------------------------------------------------
Example:
http://www.targetexample.com/path_of_hola/admin/cms/htmltags.php?
datei=./sec/data.php
shows you the username and password of the administrator!
- - - --------------------------------------------------------------------
Solution:
Put the following code at the beginning of htmltags.php
<?
include_once('./sec/data.php');
include_once('./sec/auth.php');
?>
- - - --------------------------------------------------------------------
[ reply ]