Text Rider Lets Remote Users Obtain Authentication Information
|
|
SecurityTracker Alert ID: 1015533
|
|
SecurityTracker URL: http://securitytracker.com/id?1015533
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 24 2006
|
Impact: Disclosure of authentication information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 2.4
|
Description: Aliaksandr Hartsuyeu of eVuln reported a vulnerability in Text Rider. A remote user can obtain authentication information.
In the default configuration, the software does not protect access to the 'data/userlist.txt' file, which contains hashed passwords.
A remote user can obtain the hashed password for the administrator and then supply the hashed password in a cookie to obtain administrative
privileges on the target application.
With administrative privileges, the user can edit the 'config.php' file and upload arbitrary
files for execution.
A demonstration exploit URL is provided:
http://[target]/textrider/data/userlist.txt
The original
advisory is available at:
http://evuln.com/vulns/46/summary.html
|
Impact: A remote user can obtain authentication information.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: robot.ir/blog/mollasadra/textrider/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Alex <alex@evuln.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 24 Jan 2006 19:34:38 +0300
From: Alex <alex@evuln.com>
Subject: [eVuln] Text Rider Sensitive Information Disclosure
|
ew eVuln Advisory:
Text Rider Sensitive Information Disclosure
http://evuln.com/vulns/46/summary.html
--------------------Summary----------------
Software: Text Rider
Sowtware's Web Site: http://robot.ir/blog/mollasadra/textrider/
Versions: 2.4
Critical Level: Dangerous
Type: Sensitive Information Disclosure
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
eVuln ID: EV0046
-----------------Description---------------
Directory data isn't protected by htaccess in default installiation.
This can be used to retrieve registered user's information including
logins and password's md5 hashes.
Cookie-based authentication is threatened.
To authenticate as administrator cookies need to contain the folowing:
username=[admin user]
password=[md5 hash]
Administrator has an ability to edit "config.php" file and upload
arbitrary files.
System access is possible.
--------------Exploit----------------------
URL Example:
http://host/textrider/data/userlist.txt
--------------Solution---------------------
No Patch available.
--------------Credit-----------------------
Original Advisory:
http://evuln.com/vulns/46/summary.html
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
|
|
