XRayCMS 1.1.1 SQL Injection

`# Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability  
# Date: 2/5/2012  
# Author: chap0  
# Software Link: http://sourceforge.net/projects/xraycms/files/latest/download  
# Version: 1.1.1  
# Tested on: Ubuntu  
XRay CMS is vulnerable to a SQL Injection attack which allows  
authentication bypass into the admins account. If a malicious  
user supplies ' or 1=1# into the applications user name field  
they will be logged into the applications admin account.  
Jan 29, 2012 – Contacted Vendor No Response  
Feb 05, 2012 – Public Disclosure  
Since the vendor did not reply we attempted to create our own  
fixes for this issue. The vulnerability exist in “login2.php”  
on lines 20 and 21.  
17 if(!isset($_POST['username'])) header("Location: login.php?error_username");  
18 if(!isset($_POST['password'])) header("Location: login.php?error_password");  
19  
20 $user = $_POST['username'];  
21 $pass = $_POST['password'];  
If the lines 20 and 21 are changed to:  
$user = mysql_real_escape_string($_POST['username']);  
$pass = mysql_real_escape_string($_POST['password']);  
This will prevent the sql injection from happening in the user name field.  
  
  
`