Home / exploitsPDF  

Wowondersocial user account hijacking

Posted on 30 November -0001

<HTML><HEAD><TITLE>wowondersocial  user account hijacking </TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Exploit Title: wowondersocial  user account hijacking 
# Exploit Author: Al-mamon rasool abdali hussain
# Vendor Homepage: http://www.wowonder.com
# Version: All 
# Tested on: linux 

the Vulnerability in login system that create predictable user id and send its over session  when try to check user access  the system will check using  these session id
in file  assets/includes/functions_one.php
line 86  the function 
============================================================================
function Wo_CreateLoginSession($user_id = 0) {
    global $sqlConnect;
    if (empty($user_id)) {
        return false;
    }
    $time     = strtotime("2 days ago");
    $user_id  = Wo_Secure($user_id); 
    $hash     = sha1(rand(111111111, 999999999)) . md5(microtime()) . rand(11111111, 99999999) . md5(rand(5555, 9999));
    $query_one    = mysqli_query($sqlConnect, "DELETE FROM " . T_APP_SESSIONS . " WHERE `user_id` = '{$user_id}' AND `platform` = 'web' AND `time` < $time");
    $query_two    = mysqli_query($sqlConnect, "DELETE FROM " . T_APP_SESSIONS . " WHERE `session_id` = '{$hash}'");
    if ($query_two) {
        $query_three    = mysqli_query($sqlConnect, "INSERT INTO " . T_APP_SESSIONS . " (`user_id`, `session_id`, `platform`, `time`) VALUES('{$user_id}', '{$hash}', 'web', " . time() . ")");
        if ($query_three) {
            return $hash;
        } 
    }
}
=============================================================================
the id is created in     $hash     = sha1(rand(111111111, 999999999)) . md5(microtime()) . rand(11111111, 99999999) . md5(rand(5555, 9999));
these id  sent over session  and also been stored as cookies   used to verify  the user identity in all the  system  
the exploit is to use social engineering and make the target user login in specific  time then do brute force for the rand values and already rand  function has been  exploited from long  time and its value can be predicated in some cases
</BODY></HTML>

 

TOP

Malware :

Exploits :