Date: Mon, 23 Apr 2018 06:41:09 +0200 From: Karsten König <mail@...enig.net> To: oss-security@...ts.openwall.com, fulldisclosure@...lists.org Subject: Authorization bypass in PHPLiteAdmin since 1.9.5 Hello, I found a small issue in PHPLiteAdmin. It's an authorization bypass which works since version 1.9.5 from 2014 (current is 18.104.22.168) because PLA uses '==' instead of '===' for the password comparison in 'attemptGrant' of the 'Authorization' class. If the password is set to one which correspondends to a number in scientific notation, one could easier bruteforce the password or bypass it completely, e.g.: php > var_dump('200' == '2e2'); bool(true) php > var_dump('0' == '0e2'); bool(true) php > var_dump('0' == '0e2342'); bool(true) I opened an issue at GitHub for this and have written about it (section 2 is the interesting one for this issue). Best, Karsten  https://github.com/phpLiteAdmin/pla/issues/11  http://k3research.outerhaven.de/posts/small-mistakes-lead-to-big-problems.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.