# Date: 3/5/2012
# Author: team ' and 1=1--
# Software Link: http://www.phpcollab.com/
# Version: 2.5
# Vulnerability was found during the AthCon IT Security Conference CTF
#CTF organizer: echothrust

We identified that the PhpCollab application installed under
http://192.0.0.2/phpcollab/ allows the unauthenticated access of all
authenticated content. Specifically when requesting a URL that requires
authentication, such as:
http://192.0.0.2/phpcollab/clients/listclients.php, the server responds
with a redirect (location header) to '../index.php?session=false', which
displays a session error and the login form. However upon inspecting the
response of the request, we can clearly see that all the application data
is returned. This issue allows us to access a number of PhpCollab pages
without any authentication (it must be noted that some of the
administration pages are not available when exploiting the issue). As an
example by using the following command an attacker can retrieve the phpinfo
of the server:
curl -i http://192.0.0.2/phpcollab/administration/phpinfo.php
phpinfo reveals that the system is:
Linux lamp.acmesec.fake 3.1.0-7.fc16.i686.PAE #1 SMP Tue Nov 1 20:53:45 UTC
2011 i686