exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

webspell40-multi.txt

webspell40-multi.txt
Posted Feb 24, 2007
Authored by Robin Verton

WebSpell versions greater than 4.0 suffer from authentication bypass and arbitrary code execution flaws.

tags | exploit, arbitrary, code execution
SHA-256 | 8467b9c101022d381e98b3f6b888b3fa5bea9ca1d685b2b19003a3b4eb7b32ee

webspell40-multi.txt

Change Mirror Download
WebSpell Authentication Bypass and arbitrary code execution

Vendor : WebSpell
URL : http://www.webspell.org/
Version : All
Risk : SQL Injection, unchecked file upload

Description:
webSPELL is a free Content Management System (CMS) for clans and gaming communities, providing all needed features like forums,
gallery, clanwar system. Because of some serious flaws in the login and cookie-handling function, login can be easily bypassed and
arbitrary php code executed via uploading a php file.
Notes: magic_quotes_gpc() has to be set OFF

Details:
Due to an SQL Injection via the sended 'ws_auth' cookie, WebSpell is vulnerable to an Authentication Bypass.

$login_per_cookie = false;

if(isset($_COOKIE['ws_auth']) AND !isset($_SESSION['ws_auth'])) {

$login_per_cookie = true;

$_SESSION['ws_auth'] = $_COOKIE['ws_auth'];

}



systeminc('login');

[...]

if(stristr($_SESSION['ws_auth'], "userid")===FALSE){

$authent = explode(":", $_SESSION['ws_auth']);

$ws_user = $authent[0];

$ws_pwd = $authent[1];

$check = safe_query("SELECT userID FROM ".PREFIX."user WHERE userID='$ws_user' AND password='$ws_pwd'");

while($ds=mysql_fetch_array($check)) {

$loggedin=true;

$userID=$ds['userID'];

}
}

As seen in the above codee, the Cookie 'ws_auth' is divided into two parts: The userid and the password.
With the following cookie you can bypass this function and login as admin(userid 1):

1;' OR '1'='1

When 'logged in' an PHP-file with arbitrary code can be uploaded via the "add squad" feature.

Solution:
Use mysql_real_escape_String() or addslashes() for the safe_query()

Credits:
Robin Verton < r.verton at gmail com>

Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close