~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Product: PHPNews
Version: 1.2.5 Release, bugfix 1.2.6 (and previous)
URL: http://newsphp.sourceforge.net/
VULNERABILITY CLASS: SQL injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[PRODUCT DESCRIPTION]
PHPNews is a popular script for news posting written in PHP (MySQL based).

[VULNERABILITY]

Vulnerable script: auth.php

[code]
   else if(isset($_POST['user']) && isset($_POST['password']))
  {
    $in_user = $_POST['user'];         // <-- not filtered
    $in_password = $_POST['password'];
  }

  $result = mysql_query('SELECT * FROM ' . $db_prefix . 'posters WHERE username = \'' . $in_user . '\' AND password = password(\'' . $in_password . '\')');
  $dbQueries++;

  if(mysql_numrows($result) != 0)
  {
    $auth = true;
    $_SESSION['user'] = $in_user;
    $_SESSION['password'] = $in_password;
  }
[/code]

In case magic_quotes_gpc=0, an attacker can inject SQL statements through $_POST['user'] parameter.

Example of exploitation:
In the login form type "whatever' or '1'='1'/*" in the "Username" field and
"whatever" in the "Password" field (without double quotes).
Or just use "admin'/*" as username (where "admin" - is real login name of administrator).

Possible scenario of attack. Attacker can:
[1] log in admin panel, using SQL injection
[2] upload PHP file through "Upload Images" function (index.php?action=images) and have fun with php shell
or edit template (index.php?action=modtemp) and put backdoor code into it.


[Bugfix]:

 [code]
   $in_user = $_POST['user'];       
 [/code]

replace with:

 [code]
   if (!get_magic_quotes_gpc())  {$in_user=addslashes($_POST['user']);}
   else {$in_user = $_POST['user']; } 
 [/code]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[CREDITS]
RST/GHC
http://www.ghc.ru
http://rst.void.ru
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~