Bugtraq mailing list archives
Virginity Security Advisory 2003-001 : Hola CMS - Admin Password Disclosure by Include vulnerability
From: Virginity Security <advisory () konfiweb de>
Date: 13 Aug 2003 22:26:06 -0000
- - - -------------------------------------------------------------------- Virginity Security Advisory 2003-001 - - - -------------------------------------------------------------------- DATE : 2003-08-13 03:11 GMT TYPE : remote VERSIONS AFFECTED : <== hola-cms-1.2.9-10 (http://holacms.drunkencat.net/) AUTHOR : Virginity - - - -------------------------------------------------------------------- Description: I found a security bug in Hola CMS with which you can get the admin password. The bug is in the htmltags.php - the file was written to edit an internal file. The Problem is htmltags.php doesn't check if you are logged in as administrator so you can include the unprotected passwordfile and htmltags.php shows the password file which you can edit freely or just steal the password to gain possible acces to the whole server. Author of the Software has been notified. - - - -------------------------------------------------------------------- Example: http://www.targetexample.com/path_of_hola/admin/cms/htmltags.php? datei=./sec/data.php shows you the username and password of the administrator! - - - -------------------------------------------------------------------- Solution: Put the following code at the beginning of htmltags.php <? include_once('./sec/data.php'); include_once('./sec/auth.php'); ?> - - - --------------------------------------------------------------------
Current thread:
- Virginity Security Advisory 2003-001 : Hola CMS - Admin Password Disclosure by Include vulnerability Virginity Security (Aug 13)