('binary' encoding is not supported, stored as-is)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Product: PHPNews
Version: 1.2.5 Release, bugfix 1.2.6 (and previous)
URL:
http://newsphp.sourceforge.net/
VULNERABILITY CLASS: SQL injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[PRODUCT DESCRIPTION]
PHPNews is a popular script for news posting written in PHP (MySQL based).
[VULNERABILITY]
Vulnerable script: auth.php
[code]
else if(isset($_POST['user']) && isset($_POST['password']))
{
$in_user = $_POST['user']; // <-- not filtered
$in_password = $_POST['password'];
}
$result = mysql_query('SELECT * FROM ' . $db_prefix . 'posters WHERE username = \'' . $in_user . '\' AND password = password(\'' . $in_password . '\')');
$dbQueries++;
if(mysql_numrows($result) != 0)
{
$auth = true;
$_SESSION['user'] = $in_user;
$_SESSION['password'] = $in_password;
}
[/code]
In case magic_quotes_gpc=0, an attacker can inject SQL statements through $_POST['user'] parameter.
Example of exploitation:
In the login form type "whatever' or '1'='1'/*" in the "Username" field and
"whatever" in the "Password" field (without double quotes).
Or just use "admin'/*" as username (where "admin" - is real login name of administrator).
Possible scenario of attack. Attacker can:
[1] log in admin panel, using SQL injection
[2] upload PHP file through "Upload Images" function (index.php?action=images) and have fun with php shell
or edit template (index.php?action=modtemp) and put backdoor code into it.
[Bugfix]:
[code]
$in_user = $_POST['user'];
[/code]
replace with:
[code]
if (!get_magic_quotes_gpc()) {$in_user=addslashes($_POST['user']);}
else {$in_user = $_POST['user']; }
[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[CREDITS]
RST/GHC
http://www.ghc.ru
http://rst.void.ru
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Received on Jul 20 2005
Intro
