CCLeague Pro <= 1.2 Insecure Cookie Authentication Vulnerability

🗓️ 22 Jun 2008 00:00:00Reported by RootType
CCLeague Pro <= 1.2 Insecure Cookie Authentication Vulnerability. Multiple insecure cookie validation issues in CCLeague Pro 1.2 and earlier versions allow unauthorized access to admin area, due to a vulnerability in the use of PHPSESSID cookie

                                                -[*]+================================================================================+[*]-
-[*]+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CCLeague&nbsp;Pro&nbsp;&lt;=&nbsp;1.2&nbsp;Insecure&nbsp;Cookie&nbsp;Authentication&nbsp;Vulnerability&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+[*]-
-[*]+================================================================================+[*]-



[*]&nbsp;Discovered&nbsp;By:&nbsp;t0pP8uZz
[*]&nbsp;Discovered&nbsp;On:&nbsp;19&nbsp;JUNE&nbsp;2008
[*]&nbsp;Script&nbsp;Download:&nbsp;http://castillocentral.com/
[*]&nbsp;DORK:&nbsp;&quot;Powered&nbsp;by&nbsp;CCLeague&nbsp;Pro&quot;&nbsp;&nbsp;(alot&nbsp;of&nbsp;sites&nbsp;removed&nbsp;dork,&nbsp;so&nbsp;find&nbsp;another)



[*]&nbsp;Vendor&nbsp;Has&nbsp;Not&nbsp;Been&nbsp;Notified!



[*]&nbsp;DESCRIPTION:&nbsp;

	CCLeage&nbsp;Pro&nbsp;1.2&nbsp;and&nbsp;all&nbsp;prior&nbsp;versions&nbsp;suffer&nbsp;from&nbsp;multiple&nbsp;insecure&nbsp;cookie&nbsp;validation&nbsp;vulnerabilitys.
	
	Lets&nbsp;take&nbsp;a&nbsp;look&nbsp;at&nbsp;a&nbsp;line&nbsp;from&nbsp;the&nbsp;&quot;admin.php&quot;&nbsp;file&nbsp;from&nbsp;&quot;CCLeage&nbsp;Pro&nbsp;1.2&quot;

	CODE&nbsp;LINE&nbsp;52&nbsp;(admin.php):&nbsp;
		if($_COOKIE['PHPSESSID']&nbsp;==&nbsp;session_id(&nbsp;&nbsp;)&nbsp;&amp;&amp;&nbsp;$_COOKIE['type']&nbsp;==&nbsp;&quot;admin&quot;)&nbsp;{&nbsp;..&nbsp;}

	As&nbsp;we&nbsp;can&nbsp;see&nbsp;above,&nbsp;the&nbsp;script&nbsp;checks&nbsp;to&nbsp;see&nbsp;if&nbsp;a&nbsp;cookie&nbsp;is&nbsp;set&nbsp;and&nbsp;matches&nbsp;a&nbsp;value,&nbsp;as&nbsp;we&nbsp;know&nbsp;this&nbsp;is&nbsp;very&nbsp;easy&nbsp;to&nbsp;bypass&nbsp;by&nbsp;creating&nbsp;a&nbsp;cookie,
	but&nbsp;now&nbsp;what&nbsp;above&nbsp;the&nbsp;&quot;$_COOKIE['PHPSESSID']&nbsp;==&nbsp;session_id(&nbsp;&nbsp;)&quot;&nbsp;how&nbsp;do&nbsp;we&nbsp;bypass&nbsp;this&nbsp;you&nbsp;ask?

	well&nbsp;in&nbsp;some&nbsp;versions&nbsp;this&nbsp;part&nbsp;doesnt&nbsp;even&nbsp;exist,&nbsp;but&nbsp;most&nbsp;hosts&nbsp;are&nbsp;running&nbsp;the&nbsp;upto&nbsp;date&nbsp;versions&nbsp;so&nbsp;we&nbsp;still&nbsp;need&nbsp;a&nbsp;way&nbsp;to&nbsp;bypass.

	anyway,&nbsp;the&nbsp;php&nbsp;function&nbsp;session_id&nbsp;checks/returns&nbsp;the&nbsp;PHPSESSID&nbsp;if&nbsp;any,&nbsp;and&nbsp;here&nbsp;it&nbsp;is&nbsp;returning&nbsp;the&nbsp;sessionid,&nbsp;since&nbsp;we&nbsp;havent&nbsp;created&nbsp;any&nbsp;session
	the&nbsp;function&nbsp;will&nbsp;return&nbsp;&quot;&quot;&nbsp;(not&nbsp;null),&nbsp;so&nbsp;all&nbsp;we&nbsp;need&nbsp;to&nbsp;do&nbsp;is&nbsp;make&nbsp;our&nbsp;PHPSESSID&nbsp;match&nbsp;this,&nbsp;and&nbsp;since&nbsp;its&nbsp;grabbing&nbsp;it&nbsp;from&nbsp;a&nbsp;cookie&nbsp;thats&nbsp;simple.
	
	at&nbsp;the&nbsp;minute&nbsp;our&nbsp;PHPSESSID&nbsp;will&nbsp;be&nbsp;some&nbsp;random&nbsp;hash,&nbsp;so&nbsp;we&nbsp;can&nbsp;simply&nbsp;change&nbsp;this&nbsp;by&nbsp;overwriting&nbsp;the&nbsp;cookie.

	See&nbsp;the&nbsp;javascript&nbsp;code&nbsp;below&nbsp;in&nbsp;a&nbsp;second&nbsp;to&nbsp;successfully&nbsp;exploit&nbsp;this.

	Once&nbsp;you&nbsp;have&nbsp;run&nbsp;the&nbsp;javascript&nbsp;code&nbsp;in&nbsp;your&nbsp;browser,&nbsp;you&nbsp;will&nbsp;be&nbsp;able&nbsp;to&nbsp;visit&nbsp;the&nbsp;&quot;admin.php&quot;&nbsp;area&nbsp;without&nbsp;having&nbsp;to&nbsp;login,&nbsp;but&nbsp;now
	you&nbsp;probarly&nbsp;see&nbsp;alot&nbsp;of&nbsp;errors,&nbsp;this&nbsp;is&nbsp;because&nbsp;the&nbsp;script&nbsp;attempts&nbsp;to&nbsp;load&nbsp;the&nbsp;admin&nbsp;preferences&nbsp;based&nbsp;on&nbsp;a&nbsp;cookie,&nbsp;since&nbsp;we&nbsp;dont&nbsp;have&nbsp;this&nbsp;cookie&nbsp;set
	its&nbsp;pulling&nbsp;non-existent&nbsp;data&nbsp;from&nbsp;the&nbsp;mysql&nbsp;database.

	so&nbsp;once&nbsp;again&nbsp;we&nbsp;need&nbsp;to&nbsp;set&nbsp;another&nbsp;cookie&nbsp;which&nbsp;needs&nbsp;to&nbsp;contain&nbsp;a&nbsp;existing&nbsp;admins&nbsp;email&nbsp;address,&nbsp;this&nbsp;should&nbsp;be&nbsp;too&nbsp;hard&nbsp;to&nbsp;obtain&nbsp;from&nbsp;sniffing&nbsp;around
	the&nbsp;site.

	here&nbsp;is&nbsp;the&nbsp;line&nbsp;of&nbsp;code&nbsp;from&nbsp;the&nbsp;admin.php&nbsp;which&nbsp;attempts&nbsp;to&nbsp;select&nbsp;the&nbsp;admin&nbsp;config&nbsp;from&nbsp;the&nbsp;db.

	CODE&nbsp;LINE&nbsp;67&nbsp;(admin.php):&nbsp;$admininfo&nbsp;=&nbsp;mysql_query(&quot;SELECT&nbsp;*&nbsp;FROM&nbsp;&quot;.$_CONF['tprefix'].&quot;administrators&nbsp;WHERE&nbsp;contact_email&nbsp;=&nbsp;'$_COOKIE[u]'&nbsp;LIMIT&nbsp;0,1&quot;);	

	there&nbsp;is&nbsp;also&nbsp;a&nbsp;sql&nbsp;injection&nbsp;in&nbsp;the&nbsp;above&nbsp;line,&nbsp;if&nbsp;magic&nbsp;quotes&nbsp;are&nbsp;off,&nbsp;so&nbsp;you&nbsp;rippers&nbsp;dont&nbsp;bother&nbsp;reposting&nbsp;that&nbsp;has&nbsp;a&nbsp;seperate&nbsp;vulnerability.

	Thats&nbsp;about&nbsp;it,&nbsp;Check&nbsp;below&nbsp;for&nbsp;the&nbsp;javascript&nbsp;code&nbsp;which&nbsp;will&nbsp;craft&nbsp;the&nbsp;cookies&nbsp;for&nbsp;you.

		Goodluck!



[*]&nbsp;Vulnerability/Javascript:
	
	javascript:document.cookie&nbsp;=&nbsp;&quot;type=admin;&nbsp;path=/&quot;;&nbsp;document.cookie&nbsp;=&nbsp;&quot;PHPSESSID=;&nbsp;path=/&quot;;&nbsp;//&nbsp;this&nbsp;will&nbsp;create&nbsp;one&nbsp;cookie&nbsp;and&nbsp;null&nbsp;the&nbsp;other
	javascript:document.cookie&nbsp;=&nbsp;&quot;[email protected];&nbsp;path=/&quot;;&nbsp;//&nbsp;replace&nbsp;the&nbsp;email&nbsp;with&nbsp;a&nbsp;existent&nbsp;admin&nbsp;email&nbsp;from&nbsp;the&nbsp;site,&nbsp;if&nbsp;this&nbsp;isnt&nbsp;correct&nbsp;your&nbsp;not&nbsp;gona&nbsp;get&nbsp;very&nbsp;far.



[*]&nbsp;NOTE/TIP:&nbsp;


	Use&nbsp;the&nbsp;dork&nbsp;and&nbsp;find&nbsp;a&nbsp;site,&nbsp;navigate&nbsp;to&nbsp;the&nbsp;site,&nbsp;once&nbsp;at&nbsp;the&nbsp;site&nbsp;run&nbsp;the&nbsp;above&nbsp;javascript&nbsp;code&nbsp;(paste&nbsp;into&nbsp;your&nbsp;address&nbsp;bar),&nbsp;dont&nbsp;forget
	to&nbsp;replace&nbsp;the&nbsp;email&nbsp;in&nbsp;the&nbsp;second&nbsp;javascript&nbsp;line.

	after&nbsp;you&nbsp;have&nbsp;done&nbsp;the&nbsp;above&nbsp;steps&nbsp;visit&nbsp;the&nbsp;admin&nbsp;area&nbsp;at&nbsp;&quot;admin.php&quot;



[*]&nbsp;GREETZ:&nbsp;

	milw0rm.com,&nbsp;h4ck-y0u.org,&nbsp;Offensive-Security.com,&nbsp;CipherCrew&nbsp;!



[-]&nbsp;peace,&nbsp;

	t0pP8uZz



-[*]+================================================================================+[*]-
-[*]+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CCLeague&nbsp;Pro&nbsp;&lt;=&nbsp;1.2&nbsp;Insecure&nbsp;Cookie&nbsp;Authentication&nbsp;Vulnerability&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+[*]-
-[*]+================================================================================+[*]-
22 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1
CCLeague Pro &lt;= 1.2 Insecure Cookie Authentication Vulnerability

CCLeague Pro <= 1.2 Insecure Cookie Authentication Vulnerability
