Date: Mon, 23 Apr 2018 06:41:09 +0200 From: Karsten König <mail@...enig.net> To: oss-security@...ts.openwall.com, fulldisclosure@...lists.org Subject: Authorization bypass in PHPLiteAdmin since 1.9.5 Hello, I found a small issue in PHPLiteAdmin. It's an authorization bypass which works since version 1.9.5 from 2014 (current is 18.104.22.168) because PLA uses '==' instead of '===' for the password comparison in 'attemptGrant' of the 'Authorization' class. If the password is set to one which correspondends to a number in scientific notation, one could easier bruteforce the password or bypass it completely, e.g.: php > var_dump('200' == '2e2'); bool(true) php > var_dump('0' == '0e2'); bool(true) php > var_dump('0' == '0e2342'); bool(true) I opened an issue at GitHub for this and have written about it (section 2 is the interesting one for this issue). Best, Karsten  https://github.com/phpLiteAdmin/pla/issues/11  http://k3research.outerhaven.de/posts/small-mistakes-lead-to-big-problems.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ