XRayCMS 1.1.1 SQL Injection Vulnerability

vendor:

XRayCMS

by:

chap0

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: XRayCMS

Affected Version From: 1.1.1

Affected Version To: 1.1.1

Patch Exists: YES

Related CWE: N/A

CPE: 2.3:a:xraycms:xraycms:1.1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu

2012

XRayCMS 1.1.1 SQL Injection Vulnerability

XRay CMS is vulnerable to a SQL Injection attack which allows authentication bypass into the admins account. If a malicious user supplies ' or 1=1# into the applications user name field they will be logged into the applications admin account.

Mitigation:

Change lines 20 and 21 of “login2.php” to: $user = mysql_real_escape_string($_POST['username']); $pass = mysql_real_escape_string($_POST['password']);

Source

Exploit-DB raw data:

# Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability
# Date: 2/5/2012
# Author: chap0
# Software Link: http://sourceforge.net/projects/xraycms/files/latest/download
# Version: 1.1.1
# Tested on: Ubuntu


XRay CMS is vulnerable to a SQL Injection attack which allows 
authentication bypass into the admins account. If a malicious 
user supplies ' or 1=1# into the applications user name field 
they will be logged into the applications admin account.


Jan 29, 2012 – Contacted Vendor No Response
Feb 05, 2012 – Public Disclosure

Since the vendor did not reply we attempted to create our own
fixes for this issue. The vulnerability exist in “login2.php” 
on lines 20 and 21.

17	if(!isset($_POST['username'])) header("Location: login.php?error_username");
18	if(!isset($_POST['password'])) header("Location: login.php?error_password");
19		
20	$user = $_POST['username'];
21	$pass = $_POST['password'];

If the lines 20 and 21 are changed to:

$user = mysql_real_escape_string($_POST['username']);
$pass = mysql_real_escape_string($_POST['password']);

This will prevent the sql injection from happening in the user name field.