QUOTE
PHPNews SQL injection vulnerability

Product: PHPNews
Version: 1.2.5 Release, bugfix 1.2.6 (and previous)
URL: http://newsphp.sourceforge.net/
VULNERABILITY CLASS: SQL injection

[PRODUCT DESCRIPTION]
PHPNews is a popular script for news posting written in PHP (MySQL based).


[VULNERABILITY]

Vulnerable script: auth.php

CODE

  else if(isset($_POST['user']) && isset($_POST['password']))
 {
   $in_user = $_POST['user']; // <-- not filtered
   $in_password = $_POST['password'];
 }


 $result = mysql_query('SELECT * FROM ' . $db_prefix . 'posters WHERE username = \'' . $in_user . '\' AND password = password(\'' . $in_password . '\')');
 $dbQueries++;


 if(mysql_numrows($result) != 0)
 {
   $auth = true;
   $_SESSION['user'] = $in_user;
   $_SESSION['password'] = $in_password;
 }


In case magic_quotes_gpc=0, an attacker can inject SQL statements through $_POST['user'] parameter.

Example of exploitation:
In the login form type "whatever' or '1'='1'/*" in the "Username" field and
"whatever" in the "Password" field (without double quotes).
Or just use "admin'/*" as username (where "admin" - is real login name of administrator).

Possible scenario of attack. Attacker can:
[1] log in admin panel, using SQL injection
[2] upload PHP file through "Upload Images" function (index.php?action=images) and have fun with php shell
or edit template (index.php?action=modtemp) and put backdoor code into it.

[Bugfix]:

CODE

  $in_user = $_POST['user'];


replace with:

CODE

  if (!get_magic_quotes_gpc()) {$in_user=addslashes($_POST['user']);}
  else {$in_user = $_POST['user']; }


[CREDITS]
RST/GHC



Source: http://seclists.org/lists/bugtraq/2005/Jul/0328.html