AdCycle AdLogin.pm Admin Autentication Bypass Vulnerability
BID:3032
Info
AdCycle AdLogin.pm Admin Autentication Bypass Vulnerability
| Bugtraq ID: | 3032 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 13 2001 12:00AM |
| Updated: | Jul 13 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on July 13th, 2001 by qDefense Advisories <[email protected]> |
| Vulnerable: |
Adcycle.com Adcycle 1.15 Adcycle.com Adcycle 1.14 Adcycle.com Adcycle 1.13 Adcycle.com Adcycle 1.12 Adcycle.com Adcycle 1.0 Adcycle.com Adcycle 0.78 b Adcycle.com Adcycle 0.77 b Adcycle.com Adcycle 0.77 |
| Not Vulnerable: |
Adcycle.com Adcycle 1.16 |
Discussion
AdCycle AdLogin.pm Admin Autentication Bypass Vulnerability
AdCycle is a series of scripts to facilitate ad banner rotation on a website. It is backended with a MySQL database. Adcycle is distributed as shareware.
The user authentication script that is bundled with AdCycle is vulnerable to an input validation attack.
Unchecked user-input is included in SQL queries. It is possible for attackers to construct input that will alter the logic of the query that is using during the authentication process. Attackers can authenticate as administrators without having valid credentials.
If exploited the attacker would have all the privileges of an administrator of the AdCycle service, including the ability to change ad banners.
It is yet undetermined whether this issue can be exploited to execute other arbitrary MySQL commands.
AdCycle is a series of scripts to facilitate ad banner rotation on a website. It is backended with a MySQL database. Adcycle is distributed as shareware.
The user authentication script that is bundled with AdCycle is vulnerable to an input validation attack.
Unchecked user-input is included in SQL queries. It is possible for attackers to construct input that will alter the logic of the query that is using during the authentication process. Attackers can authenticate as administrators without having valid credentials.
If exploited the attacker would have all the privileges of an administrator of the AdCycle service, including the ability to change ad banners.
It is yet undetermined whether this issue can be exploited to execute other arbitrary MySQL commands.
Exploit / POC
AdCycle AdLogin.pm Admin Autentication Bypass Vulnerability
This example was submitted by qDefense Advisories <[email protected]>:
If an attacker signs in, using a account name of "ADMIN" and a password of
X ' OR 1 #
an attacker can cause AdCycle to use the following SQL command:
"SELECT * FROM ad WHERE LOGIN='ADMIN' AND PASSWORD='X' OR 1 #'
This example was submitted by qDefense Advisories <[email protected]>:
If an attacker signs in, using a account name of "ADMIN" and a password of
X ' OR 1 #
an attacker can cause AdCycle to use the following SQL command:
"SELECT * FROM ad WHERE LOGIN='ADMIN' AND PASSWORD='X' OR 1 #'
Solution / Fix
AdCycle AdLogin.pm Admin Autentication Bypass Vulnerability
Solution:
The vendor has released an upgrade which addresses this issue.
Solution:
The vendor has released an upgrade which addresses this issue.
References
AdCycle AdLogin.pm Admin Autentication Bypass Vulnerability
References:
References:
- Adcycle homepage (Adcycle.com)