Get admin level on Goldlink script v3.0

2007.10.25
Credit: Weke
Risk: Medium
Local: No
Remote: Yes
CWE: N/A


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

There is a bug in script of links Goldlink v3.0 (http://www.goldscripts.com/goldlink.php). You can access to panel with admin privileges. The bug is in variables.php file: function Acceso() { global $extension; global $tb_admin; global $HTTP_COOKIE_VARS; $vadmin_login=$HTTP_COOKIE_VARS["vadmin_login"]; $vadmin_pass=$HTTP_COOKIE_VARS["vadmin_pass"]; $link=Conectarse(); if (!(isset($vadmin_login) && isset($vadmin_pass))) { if (mysql_query("select * from $tb_admin where Login='$vadmin_login' && Password='$vadmin_pass'",$link)) { mysql_close($link); header("Location: index.$extension"); exit(); } } } The bug is in $vadmin_login and $vadmin_pass proccesing. One idea is set: vadmin_login = ' OR Login LIKE '% and vadmin_pass = ' OR Password LIKE '% If you create two cookies with thoses values and go to: http://www.victim.com/godllink/admin/admin.php you will go to goldlink panel with level admin, and you will be able to modify links, users passwords, admin password, etc. For fix it add the two lines before 'if (!(isset($vadmin_login) && isset($vadmin_pass))) {' in variables.php file : $vadmin_login = addslashes($vadmin_login); $vadmin_pass = addslashes($vadmin_pass); Weke http://www.programas-hacker.com


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top