[42149] in bugtraq
[eVuln] ACal Authentication Bypass & PHP Code Insertion
daemon@ATHENA.MIT.EDU (alex@evuln.com)
Thu Jan 12 19:01:12 2006
Date: 12 Jan 2006 21:56:16 -0000
Message-ID: <20060112215616.7042.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: alex@evuln.com
To: bugtraq@securityfocus.com
New eVuln Advisory:
ACal Authentication Bypass & PHP Code Insertion
--------------------Summary----------------
Software: ACal
Sowtware's Web Site: http://acalproj.sourceforge.net/
Versions: 2.2.5
Critical Level: Dangerous
Type: PHP Code Execution
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
eVuln ID: EV0025
-----------------Description---------------
Vulnerabe script: login.php
To authorize any user forum scripts checks only one cookie variable: ACalAuthenticate
Forum dont make password comparison.
Registered users can modify header.php and footer.php files. System access is possible.
--------------Exploit----------------------
Cookie: ACalAuthenticate=inside
--------------Solution---------------------
No Patch available.
--------------Credit-----------------------
Original Advisory:
http://evuln.com/vulns/25/summary.html
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
