export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information.
The Address Book 1.04e suffers from a critical vulnerability where the export.php script exposes sensitive user credentials, including usernames and password hashes, in a publicly accessible file. This allows attackers to easily compromise user accounts and potentially gain complete control of the application and the underlying server. This vulnerability presents a high risk of data breach and system compromise.
Step 1: Access the Vulnerable Script: The attacker identifies the export.php script, typically by browsing to its location on the web server (e.g., http://example.com/addressbook/export.php).
Step 2: Trigger the Export: The attacker likely doesn't need to provide any specific input; simply accessing the script triggers the database export process.
Step 3: Download the Exported File: The script generates a file containing the database dump, including the sensitive user credentials. The attacker downloads this file, which is publicly accessible.
Step 4: Extract Credentials: The attacker parses the downloaded file, extracting the usernames and password hashes.
Step 5: Crack Passwords: The attacker uses password cracking tools (e.g., John the Ripper, Hashcat) to attempt to crack the password hashes and obtain the original passwords.
Step 6: Account Takeover: Armed with the cracked passwords, the attacker can log in to user accounts, potentially gaining administrative access and control of the application.
The root cause of CVE-2006-4578 lies in the insecure implementation of the export.php script within The Address Book 1.04e. The script, designed to dump the MySQL database contents, inadvertently includes sensitive information such as usernames and password hashes in the exported file. The script lacks proper access controls, making the exported file publicly accessible. This design flaw, combined with the inclusion of sensitive data, creates a straightforward path for attackers to obtain user credentials. The vulnerability is a direct result of insufficient input validation and a failure to sanitize the output, leading to the exposure of sensitive data.