Summary The security vulnerabilities in Thatware allows attacker to gain administrative access to the application. Thatware is a news portal administration, open source, and freely downloaded at: http://www.atthat.com/ Vulnerable systems Thatware 0.3 Exploit 1: If we send it http://site/admin.php3?user=anyone the script will give $auth_rights = FALSE and goes on to: if (sizeof($auth_rights)>0) { $admintest=1; This will succeed and open access to all functions in admin.php3. It is caused by the fact that sizeof($x), where $x is a variable that is set but is not an array, returns 1. The following exploit will elevate 'someuser' status to admin: http://site/admin.php3?user=anyone&op=AddAdmin &add_root=&add_uname=someuser Fix: For a quick fix, simply rename admin.php3. And for those who might think security through obscurity is not quite enough, well, we should get into the code. In auth.inc.php3, use conditional to check if $admin[0] dan $admin[2] are empty (null or zero) before sending a query, e.g. if (empty($admin[0]) || empty($admin[2])){exit;} then replace if (sizeof($auth_rights)>0) with if (!empty($auth_rights)) Anyway, these won't defend us against another form of exploit. Exploit 2: Unquotted variables from user input parsed directly into SQL statements provide a way to the second exploit. For example, in user.php3, under function saveuser(): update users_info set name='$name', email='$email', femail='$femail', url='$url', bio='$bio' where uid=$uid The attacker could hijack e.g. 'god' admin account by first sending it: http://site/user.php3?op=Save%20User&email=cracker@domain &uname=god&uid=blabla%20or%20uname%3Dchar(103,111,100) that will alter email address to cracker@domain. Note that those numbers (103,111,100) are ascii sequence for 'god' (the attacker cannot just put uname%3D'god' since PHP3/4 will quote it into uname=\'god\' which will produce an invalid SQL statement). Now, simply by sending it htt://site/user.php?op=mailpasswd&uname=god will alter the admin's password to a new password, then mail the new password to cracker's mailbox. Note: using the similar method, Thatware 0.2 or below are vulnerable to users accounts hijacking (admins' reside on the different table). Fix: Simply quote all numeric data in SQL statements. Instead of "select * from users where uid=$uid", use "select * from users where uid='$uid'". MySQL automatically converts this to a number and meanwhile strips all non-numeric symbols from it. Fabian Clone (fabianclone@usa.net) ____________________________________________________________________ Get free email and a permanent address at http://www.amexmail.com/?A=1