[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Nusiorung CMS 2016 - (Login) Auth Bypass Vulnerability
From:       Vulnerability Lab <research () vulnerability-lab ! com>
Date:       2016-07-27 8:37:37
Message-ID: 0ea0f4a1-41b8-6565-8652-11ed5020e42f () vulnerability-lab ! com
[Download RAW message or body]

Document Title:
===============
Nusiorung CMS 2016 - (Login) Auth Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1875


Release Date:
=============
2016-07-13


Vulnerability Laboratory ID (VL-ID):
====================================
1875


Common Vulnerability Scoring System:
====================================
7.6


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a login auth bypass web \
vulnerability in the official Nusiorung CMS 2016.


Vulnerability Disclosure Timeline:
==================================
2016-07-13:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
An auth bypass web vulnerability has been discovered in the official Nusiorung content \
management system 2016. The vulnerability allows remote attackers to bypass the authentication \
mechanism of the web-application to compromise.

The vulnerability is located in the username and password input fields of the admin login \
module. Remote attackers  are able to perform malicious POST method requests to unauthorized \
login to the administrator panel. The vulnerability  is a classic login auth bypass issue. The \
attack vector is located to the application-side and the request method to  inject is POST.

The security risk of the auth bypass web vulnerability is estimated as high with a cvss (common \
vulnerability scoring system) count of 7.6. Exploitation of the remote auth bypass web \
vulnerability requires no user interaction or privileged web-application user account. \
Successful exploitation of the remote vulnerability results in database management system, \
account system or web-application compromise.

Request Method(s):
				[+] POST

Vulnerable Module(s):
				[+] Login

Vulnerable Parameter(s):
				[+] Gebruikersnaam(username) and Wachtwoord(Password)


Proof of Concept (PoC):
=======================
The auth bypass web vulnerability can be exploited by remote attackers without user interaction \
or privileged user account. For security demonstration or to reproduce the vulnerability follow \
the provided information and steps below to continue.

Google Dork(s):	intext:"Powered By nusiorung"

PoC: Exploitation
Username: '=' 'OR'
Password: '=' 'OR'

PoC: URL
http://localhost:8000/[PATH]/admin/index.php


Security Risk:
==============
The security risk of the auth bypass web vulnerability in the web-application login module is \
estimated as high. (CVSS 7.6)


Credits & Authors:
==================
mr_mask_black - [http://www.vulnerability-lab.com/show.php?user=mr_mask_black]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. \
Vulnerability Lab disclaims all warranties, either expressed or implied,  including the \
warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its \
suppliers are not liable in any case of damage,  including direct, indirect, incidental, \
consequential loss of business profits or special damages, even if Vulnerability-Lab or its \
suppliers have been advised  of the possibility of such damages. Some states do not allow the \
exclusion or limitation of liability for consequential or incidental damages so the foregoing  \
limitation may not apply. We do not approve or encourage anybody to break any licenses, \
policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
Contact:    admin@vulnerability-lab.com 	- research@vulnerability-lab.com 				- \
                admin@evolution-sec.com
Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- \
                evolution-sec.com/contact
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- \
                youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- \
                vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	- \
vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires \
authorization from Vulnerability Laboratory. Permission to electronically  redistribute this \
alert in its unmodified form is granted. All other rights, including the use of other media, \
are reserved by Vulnerability-Lab Research Team or  its suppliers. All pictures, texts, \
advisories, source code, videos and other information on this website is trademark of \
vulnerability-lab team & the specific  authors or managers. To record, list, modify, use or \
edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission.

				    Copyright  © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]â„¢

-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


[prev in list] [next in list] [prev in thread] [next in thread]