imei Addmimistrator’s BugBlog

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.2
Class: Remote
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: Middel
—————–Description—————
Olate download is prone to SQL injection in download.php file.
Lack of programmer’s knowledge about HTTP headers and process of assigning value to predefined global arrays, resulted to this bug.With a shallow look, on line app. 118-127 you’ll understand that […]

Olate | 2 Comments »

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.2
Class: Remote
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: Middel
—————–Description—————
Olate download is prone to Cross site scripting, cause of simple code replacing for comments in mentioned file
bug is in line about 231, that programmers simply replaced some patterns with some equivalents.
Usually, phrasing codes are a complicated process […]

Olate | 1 Comment »

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.2
Class: Remote
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: Middel
—————–Description—————
Olate download is prone to Cross site scripting, cause of trusting to unsafe variable, $_SERVER[’PHP_SELF’].
Programmers team, trusted that $_SERVER[’PHP_SELF’] contained executed php file. I was reading bug report of this issue in php support site. it was reported […]

Olate | 1 Comment »

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.1
Class: Remote
Status: Patched
Exploit: Available
Solution: Available
Discovered by: imei addmimistrator
Risk Level: High
—————–Description—————
Olate is prone to code execution vulnerability cause of trusting to user supplied inputs in environment.php file, that is a very unusable file in software.

Check out lines 86-87,
Client Version: < ?php eval("echo $pdo->getAttribute(PDO::ATTR_CLIENT_VERSION);”); ?>

Olate | 3 Comments »

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.1
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: High
—————–Description—————
There is some flews in Olate Download software, one of the popular files’ links list, Ideal for download sites, that results to bypassing authentication of site’s admin. An attacker can gain access to Admin area have full control permissions to […]

Olate | 4 Comments »