[Full-disclosure] TowerBlog <= 0.6 Admin Account View [x0n3-h4ck]

2005-04-11T00:00:00
ID SECURITYVULNS:DOC:8273
Type securityvulns
Reporter Securityvulns
Modified 2005-04-11T00:00:00

Description

-=[--------------------ADVISORY-------------------]=- -=[
]=- -=[ TowerBlog <= 0.6 ]=- -=[
]=- -=[ Author: CorryL x0n3-h4ck.org ]=- -=[
]=- -=[-----------------------------------------------------]=-

-=[+] Application: TowerBlog -=[+] Version: 0.6 -=[+] Vendor's URL: http://tower.hybryd.org/?x=home -=[+] Platform: Windows\Linux\Unix -=[+] Bug type: view admin account -=[+] Exploitation: Remote/Local -=[-] -=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~ -=[+] Reference: www.x0n3-h4ck.org ~ irc.xoned.net #x0n3-h4ck

..::[ Descriprion ]::..

TowerBlog is, in short, a single user web-log (or web journal if you will) content management system, aka CMS. While there are many others out there (MovableType and GreyMatter as linked amongst the others) none quite filled my own personal needs and desires. Mind you, this isn't meant to be an insult to the other CMS' out there, I myself used both MovableType and GreyMatter extensively for some time, however no system I could find was as powerful as I needed, nor as easily expanded. The only one that came close, was PHPNuke, but it was too bulky and bloated for my needs.

..::[ Bug ]::..

this application and' he/she cuts to a type of bug that would allow to an attacker to come in possession of very precious information as user and admin pass. This and' caused because' the data related to the admin acount are saved in a text file, that and' easily visible on the browser.

..::[ Proof Of Concept ]::..

http://host/path of blog/_dat/login

189bbbb00c5f1fb7fba9ad9285f193d1 << UserName Admin 81dc9bdb52d04dc20036dbd8313ed055 << Password Admin

the result I am the relative users and admin password in md5, the first one corresponds to the user, the second to the password

..::[ Disclousure Timeline ]::..

[10/04/2005] - Vendor notification [10/04/2005] - Vendor Response [10/04/2005] - Public disclousure

CorryL corryl80@gmail.com www.x0n3-h4ck.org Italian Security Team Fax (+39) 02700520894 Tel (+39) 06452215277 irc.xoned.net #x0n3-h4ck


www.seekstat.it is your web stat


Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/