phpPass 2 AccessControl.PHP SQL Injection Vulnerability

2003-01-13T00:00:00
ID EDB-ID:22148
Type exploitdb
Reporter frog
Modified 2003-01-13T00:00:00

Description

phpPass 2 AccessControl.PHP SQL Injection Vulnerability. CVE-2003-1533 . Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/6594/info

A problem with phpPass may allow an attacker to launch a SQL injection attack.

The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote user to inject arbitrary SQL into the database used by a vulnerable site. This may allow an attacker to view pages that would normally be restricted.

http://[target]/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''='