Boonex Dolphin 7.3.2 – Authentication Bypass

• Exploit Database
• 124 阅读

• 作者： Saadi Siddiqui
  日期： 2016-10-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40631/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  # Exploit Title : Boonex Dolphin all versoin <= 7.3 Authentication Bypass # Exploit Author: Saadat Ullah saadi_linux[@]rocketmail.com # Software Link : https://www.boonex.com # Author HomePage : http://security-geeks.blogspot.com   Proof of Concept   File: admin.inc.php Line: 187 Code: (strcmp($aProfile[&apos;Password&apos;], $passwd) != 0) $passwd is equal to Cookie parameter memberpassword Bug: According to PHP documentation strcmp will compare strings, but what if we provide an array??? So, simple bypass is to put two cookies in browser memberID=1 memberPassword[]=blah --->array This will allow the attacker to bypass the authentication and can also enter in admin panel. #Independent Pakistani Security Researcher