Home / exploitsPDF  

ESite CMS login bypass

Posted on 20 August 2013

<pre># Exploit Title:  eSite cms login  bypass 
# Google Dork:  intext::&quot;Designed &amp; Programmed by eSite&quot;  or   inurl:&quot;articlefull.php?id&quot;
# Date: 15/8/2013
# Exploit Author: Al-mamon rasool abdali hussain
# Vendor Homepage: http://esite-iq.com/
# Version: All esite-iq.com  script
# Tested on: linux 

the  Vulnerability in login  system that chack the ssesion is exist 
the login code is these
____________________________________
&lt;?php
session_start();
if (! empty($_SESSION['auth_ebook_manager'])) {
die (&quot;&lt;meta http-equiv=&quot;refresh&quot; content=&quot;0; url='admincp.php'&quot;&gt;&quot;);    
}
if (! isset($_POST['action'])) {
    echo &quot;&lt;form action=&quot;log.php?do=login&quot; method=&quot;post&quot;&gt;
    &lt;center&gt;&lt;p&gt;Admin name : &lt;input type=&quot;text&quot; name=&quot;ad&quot;&gt;&lt;/p&gt;
    &lt;p&gt;Admin Password : &lt;input type=&quot;password&quot; name=&quot;pass&quot;&gt;&lt;/p&gt;
    &lt;input type=&quot;hidden&quot; value=&quot;ok&quot; name=&quot;action&quot;&gt;
    &lt;input type=&quot;submit&quot; value=&quot;login&quot;&gt;
    &lt;/center&gt;&lt;/form&gt;&quot;;
}
else
{
    include (&quot;connection.php&quot;);
    $admin = mysql_fetch_array(mysql_query(&quot;select * from addd where admin='$_POST[ad]'&quot;));
    if (! empty($admin['admin'])) {
        $pass = md5(md5($_POST['pass']));
        if ($pass == $admin['password']) {
            $_SESSION['auth_ebook_manager'] = $admin['admin'];
            echo &quot;&lt;center&gt;Welcome $admin[admin]&lt;/center&gt;    
            &lt;meta http-equiv=&quot;refresh&quot; content=&quot;0; url='admincp.php'&quot;&gt;&quot;;
        }
        else
        {
            echo &quot;&lt;center&gt;Error !&lt;/center&gt;&quot;;
        }
    }
    else 
    {
        echo &quot;&lt;center&gt;Error !&lt;/center&gt;&quot;;
    }
}





_____________________________


so easily we will create session  from another website that is in the same server using the exploit code


1-first need to upload the exploit file into any web site in the same server
that the target hosted in

2- just execut the exploit file  and copy the ssesion that the exploit genrate its for  you

3- go to  www.xxx.com/admincp.php   and inject the session using any injecter like tamper data or  any other

now you will be loged as admin  




# in case the  web site admin user name is not admin you must  try to change  the name into exploit file 
</pre>

 

TOP

Malware :

Exploits :