Dream Gallery 2.0 Admin panel Authentication bypass

vendor:

Dream Gallery

by:

Ali BawazeEer

7,5

CVSS

HIGH

Authentication bypass

N/A

CWE

Product Name: Dream Gallery

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2016

Dream Gallery 2.0 Admin panel Authentication bypass

An Attackers are able to completely compromise the web application built upon Dream Gallery as they can gain access to the admin panel and manage the website as an admin without prior authentication! Step 1: Create a rule in No-Redirect Add-on: ^http://example.com/path/admin/login.php Step 2: Access http://example.com/path/admin/index.php

Mitigation:

Add a session check to the admin/index.php page to ensure that the user is authenticated before allowing access.

Source

Exploit-DB raw data:

<!--
# Exploit Title:  Dream Gallery 2.0 - Admin panel Authentication bypass
# Date: 13th June 2016
# Exploit Author: Ali BawazeEer
# Vendor Homepage: http://phpstaff.com.br/
# Version: 2.0

--!>


=======================================================================================================

Dream Gallery 2.0 Admin panel Authentication bypass 

Description : An Attackers are able to completely compromise the web application built upon
Dream Gallery as they can gain access to the admin panel and 
manage the website as an admin without prior authentication!


Step 1: Create a rule in No-Redirect Add-on: ^http://example.com/path/admin/login.php
Step 2: Access http://example.com/path/admin/index.php


Risk : Unauthenticated attackers are able to gain full access to the administrator panel
and thus have total control over the web application, including content change,add admin user .. etc

=======================================================================================================
potential fix 


<?php 
session_start(); 
if (!isset($_SESSION["auth"])) {         
exit(header('Location: admin/login.php')); 
} 

?>


[+] Exploit by: Ali BawazeEer
[+] Twitter:@AlibawazeEer
[+] Linkedin : https://www.linkedin.com/in/AliBawazeEer