BitForge_Authentication_Bypass

Authentication Bypass

---

Discovering an unusual column, cle, present in the planning_user table of the target SOPlanning instance led to an online research effort that resulted in finding an article showcasing multiple vulnerabilities present in the SOPlanning version below 1.53.02

Reading further into the article reveals that it is possible to bypass the authentication using both password and cle due to the way the www/process/login.php file processes the “alternative” authentication.

Although the vendor has fixed the issues, the issues themselves have not been assigned CVE

Using cle|password in the password field

Authentication successfully “bypassed”

Now that I have authenticated to the target SOPlanning instance, I can look into the RCE vulnerability