Obaidullah Sulaimankhil Improper Authentication Vuln

####################################################################

# Exploit Title : Obaidullah Sulaimankhil Improper Authentication Vulnerability
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 03/03/2019
# Vendor Homepage / Social Media : facebook.com/obaidullah.sulaimankhil
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : High
# Vulnerability Type :
CWE-287 [ Improper Authentication ]
CWE-592  [ Authentication Bypass Issues ]
CWE-305  [ Authentication Bypass by Primary Weakness ]
CWE-288  [ Authentication Bypass Using an Alternate Path or Channel ]
CWE-302 [ Authentication Bypass by Assumed-Immutable Data ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
# Reference Link : cxsecurity.com/issue/WLB-2019030013

####################################################################

# Information about Software and Owner :
************************************
Obaidullah SulaimanKhil who is web developer in Afghanhistan and developed

a script with his name Obaidullah Software for Afghani Government Websites.

####################################################################

# Impact :
**********
* When an actor claims to have a given identity, the software does not prove or insufficiently

proves that the claim is correct.

* The authentication algorithm is sound, but the implemented mechanism can be bypassed

as the result of a separate weakness that is primary to the authentication error.

* This product requires authentication, but the product has an alternate path or

channel that does not require authentication.

* The authentication scheme or implementation uses key data elements that are assumed

to be immutable, but can be controlled or modified by the attacker.

####################################################################

# Authentication Bypass Exploit :
*****************************
Admin Panel Login Path :
***********************
/Pages/AdminLogin.aspx

Admin username : admin

Admin password : admin

Usable Admin Control Panel Links :
********************************
/Pages/frmWelcomeMessageAdmin.aspx
/Pages/HistoryOfDMTVETAdmin.aspx
/Pages/AboutDMTVETAdmin.aspx
/Pages/HEDMAdmin.aspx
/Pages/frmStaffAdmin.aspx
/Pages/frmCeoMessageAdmin.aspx
/Pages/frmSliderAdmin.aspx
/Pages/frmDMTVETStructureAdmin.aspx
/Pages/frmDMTVETReport.aspx
/Pages/frmArticlesAdmin.aspx
/Pages/frmVisionAdmin.aspx
/Pages/frmPresentationsAdmin.aspx
/Pages/frmInterviewsAdmin.aspx
/Pages/frmAlbumAdmin.aspx
/Pages/frmNewsAdmin.aspx
/Pages/frmOthersAdmin.aspx
/Pages/frmContactUsAdmin.aspx

####################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

####################################################################