imei Addmimistrator’s BugBlog

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.1
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: High
—————–Description—————
There is some flews in Olate Download software, one of the popular files’ links list, Ideal for download sites, that results to bypassing authentication of site’s admin. An attacker can gain access to Admin area have full control permissions to maintaing entire site.

Bug is in result of careless authentication with cookies in Admin.php file since programmer tries to provide a Auto login system. An attacker can makes a malicious cookie guessing admin’s username and performs a full attack. Attacker also can perform a sql injection attack through that cookie.
bug is approximately in lines 60 -87.
————–Exploit———————-

cookie{ exploded into two lines }:
OD3_AutoLogin=17225df9b911486c1ccae0378094c33a::a:3:
{i:0;i:1;i:1;s:4:\”imei\”;i:2;i:2;}

first bolded value is userid of goal site’s admin {usually 1} , 2nd bolded value is user name of admin, 3rd bolded value is group of user{for admins usually 2}
first long sequence of characters are a MD5ed string of concatination of 3 above values in sequence.
———–Solution———————
Upgrade to vendor provided patch
————–Credit———————–
Discovered by: imei addmimistrator
addmimistrator(4}gmail(O}com
www.myimei.com

Posted by imei on Thursday, August 16th, 2007 at 12:55 am.