cd34
2004-12-10, 04:25 PM
Software: AutorankPHP
Title: [FW-004] accounts.php remote login exploit via SQL Injection
Summary: Ability to remotely log in and change account information with minimal information about accounts
Description: Using a specially crafted username, one can log into a trade's account in AutorankPHP and change data including username, password, email account
Impact: Traffic can be redirected to other urls, account information changed
Workaround: Modify accounts.php and add
$_POST['Username'] = mysql_real_escape_string($_POST['Username']);
$_POST['Password'] = mysql_real_escape_string($_POST['Password']);
after the <?php. This does not prevent other SQL injection attacks, but does prevent a malicious user from getting in without a password.
References:
http://firewall.com/advisories/autorankphp.html
Risk Factor: Medium
Title: [FW-004] accounts.php remote login exploit via SQL Injection
Summary: Ability to remotely log in and change account information with minimal information about accounts
Description: Using a specially crafted username, one can log into a trade's account in AutorankPHP and change data including username, password, email account
Impact: Traffic can be redirected to other urls, account information changed
Workaround: Modify accounts.php and add
$_POST['Username'] = mysql_real_escape_string($_POST['Username']);
$_POST['Password'] = mysql_real_escape_string($_POST['Password']);
after the <?php. This does not prevent other SQL injection attacks, but does prevent a malicious user from getting in without a password.
References:
http://firewall.com/advisories/autorankphp.html
Risk Factor: Medium