phpkit161.txt

`SQL Injection and PHP Code Injection Vulnerabilities in PHPKit 1.6.1  
  
Version: PHPKit 1.6.1  
Risk: High if magic_quotes_gpc = Off  
URL: http://www.phpkit.com  
  
***************************************************************************  
  
SQL Injection in include.php?path=login/member.php  
  
The parameters usernick and letters are vulnerable to SQL Injections.  
POC:  
/phpkit/include.php?path=login/member.php&letter=phuket'%20AND%20MID(user_pw,1,1)='8'/*  
  
This will show the user "phuket" if the first character of his password  
hash is '8'.  
  
SQL Injection in include.php?path=login/imcenter.php  
  
The parameter im_receiver is vulnerable to SQL Injections.  
POC: im_receiver=phuket' AND MID(user_pw,1,1)='8'/*  
  
This will print an error message like "Der von Ihnen angegebene  
Empfänger konnte nicht gefunden werden. Überprüfen Sie bitte Ihre Eingabe!"  
If the first character of the password hash is not '8'.  
  
  
PHP Code Injection in admin/admin.php?path=images.php  
  
It is possible to upload .php files to the content/images/ directory.  
Of course you need a legal admin pass first.  
  
  
  
Exploit code exists but I will not make it available to the public at  
this time.  
  
*******************************************************************************  
  
Solution:  
Turn magic_quotes on  
  
  
Phuket  
  
  
`