——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.1
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: High
—————–Description—————
There is some flews in Olate Download software, one of the popular files’ links list, Ideal for download sites, that results to bypassing authentication of site’s admin. An attacker can gain access to Admin area have full control permissions to maintaing entire site.
Bug is in result of careless authentication with cookies in Admin.php file since programmer tries to provide a Auto login system. An attacker can makes a malicious cookie guessing admin’s username and performs a full attack. Attacker also can perform a sql injection attack through that cookie.
bug is approximately in lines 60 -87.
————–Exploit———————-
cookie{ exploded into two lines }:
OD3_AutoLogin=17225df9b911486c1ccae0378094c33a::a:3:
{i:0;i:1;i:1;s:4:\”imei\”;i:2;i:2;}
first bolded value is userid of goal site’s admin {usually 1} , 2nd bolded value is user name of admin, 3rd bolded value is group of user{for admins usually 2}
first long sequence of characters are a MD5ed string of concatination of 3 above values in sequence.
———–Solution———————
Upgrade to vendor provided patch
————–Credit———————–
Discovered by: imei addmimistrator
addmimistrator(4}gmail(O}com
www.myimei.com
http://www.securityfocus.com/bid/25343
Left by imei on August 17th, 2007
I have addressed this issue in the new version of Olate Download 3.4.2 Let me know if you have any questions.
Left by gburnes on August 21st, 2007
It would be great if you would list this and the other one as patched….
Left by gburnes on August 22nd, 2007
http://secunia.com/advisories/26533/
Left by imei on August 22nd, 2007