PHP Support Tickets 1.3 SQL Injection

`PHP_S_Tickets_v1.3 SQL Injection Vulnerabilty  
================================================  
  
  
Discovered by N_A, N_A[at]tutanota.com  
=======================================  
  
  
  
Description  
============  
  
PHP Support Tickets; will allow a webmaster the ability to offer its user base a means to contact its personnel through request vouchers.  
  
  
https://sourceforge.net/projects/php-sup-tickets  
  
  
  
  
Vulnerability  
==============  
  
An SQL Injection vulnerability exists that allows unsanitized commands to be passed into the MYSQL database.  
  
The vulnerability resides inside the index.php and the config.php file:  
  
  
  
index.php:  
===========  
  
############ AUTH SYSTEM ############  
A   
IF (isset($_POST['form']) && isset($_POST['username']) && isset($_POST['password']))  
A A A {  
A A A IF (AuthUser($_REQUEST['username'], $_REQUEST['password']))  
  
  
  
  
unsanitized requests are handled by the function AuthUser which is located inside config.php:  
  
  
config.php:  
===========  
  
Function AuthUser($user, $pass)  
A A A {  
A A A $query = "A A A SELECT tickets_users_password  
A A A A A A A A A FROM tickets_users  
A A A A A A A A A WHERE tickets_users_username = '$user'  
A A A A A A A A A AND tickets_users_status != '0'";  
A   
A A A $result = @mysql_query($query);  
  
  
  
The variable $user is passed to the MYSQL query completely unchecked and unsanitized and it is possible for command injection to take place here.  
  
  
  
  
  
Email  
======  
  
N_A[at]tutanota.com  
  
--  
Securely sent with Tutanota. Claim your encrypted mailbox today!  
https://tutanota.com  
`