How did somebody exploit my programming?

[748323]

I created a basic members-only website. To ban a member, I had a script that will create a text file called "Banned user + .txt" and place that file in another directory.

Somebody found out the directory, and could create any text file he wanted and place it in that directory, and therefore banning anybody he wanted.

I created a script that will unban anybody who has been banned by the hacker, but the security hole is still there. How was this done? My website did deal with creating files in placing them in a different folder than the banned users folder. Do you think this was an exploit of my own programming, or another exploit? Thanks.

 

[MattNeeley]

Did you add any checks on the script to make sure it could only be used by you? or did you leave it open to just be run and select a name? You should always have the script check and verify that it's you that is doing the ban by logging in etc.

 

[vbkris]

>>Somebody found out the directory, and could create any text file he wanted and place it in that directory

that might just be by luck. do u display the path to this text file anywhere in your code???

Known is handfull, Unknown is worldfull

 

[Olavxxx]

maybe you should make some logging functions to your script, so that it logs ip and time/date, as well as which script made the ban.

You also need to make sure that your script is only accessed by you.

it's hard to know if this was done by someone who also has an account on your server, or if it was done by one of your users.

I would check the chmod of the folders, to see who has permissions..

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[Meekos]

Are you using a database for the users that are not banned? If so create a banned flag and activate it instead of using the .txt folder to ban members. It would be more secure.

Just a thought.

 

[ericbrunson]

Give us the URL and we'll exploit it for you and tell you how we did it.

 

[Olavxxx]

ericbrunson: lol..

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[RISTMO]

How did he have the permissions to write to the directory in the first place? Or did he just get the script url and start banning people?

Rick

http://www.ristmo.com/

 

[Olavxxx]

I think this thread is to be assumed dead.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster