Boonex Dolphin 7.3.2 - Authentication Bypass Vulnerability

ID 1337DAY-ID-26140
Type zdt
Reporter Saadi Siddiqui
Modified 2016-10-26T00:00:00


Exploit for php platform in category web applications

                                            # Exploit Title     : Boonex Dolphin all versoin <= 7.3 Authentication Bypass
# Exploit Author    : Saadat Ullah saadi_linux[@]
# Software Link     :
# Author HomePage   :
Proof of Concept
Line: 187
Code: (strcmp($aProfile['Password'], $passwd) != 0)
$passwd is equal to Cookie parameter memberpassword
According to PHP documentation strcmp will compare strings, but what if we provide an array???
So, simple bypass is to put two cookies in browser
memberPassword[]=blah --->array
This will allow the attacker to bypass the authentication and can also enter in admin panel.
#Independent Pakistani Security Researcher

# [2018-02-15]  #