BloggIT <= 1.01 (admin.php) Arbitrary code execution

2007-02-16 / 2007-02-17
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

*/ Federico Fazzi, <federico (at) autistici (dot) org [email concealed]> */ BloggIT <= 1.01 (admin.php) Arbitrary code execution */ 04/06/2006 5:48 Bug: The BloggIT have on the admin.php: require("session.inc.php"); //- session_start(); //- if ($_SESSION['login'] != "ok") header("Location: index.php"); and require() function don't include the file for test the security session. Proof of concept: The cracker have arbitrary access at: http://example/admin.php http://example/admin.php?op=add_ent http://example/admin.php?op=add_usr http://example/admin.php?op=man_ent http://example/admin.php?op=man_usr http://example/admin.php?op=man_cat http://example/admin.php?op=man_com http://example/admin.php?op=man_fil Patch: --- admin.php 2006-06-05 20:51:05.000000000 +0200 +++ admin.php 2006-06-05 20:51:23.000000000 +0200 @@ -6,7 +6,7 @@ require("config.inc.php"); require("language.inc.php"); require("parsing.inc.php"); -require("session.inc.php"); +include("session.inc.php"); print("<title>{$title} - Powered by BloggIT 1.01</title>\n"); ?>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top