SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before

[Rolf Huisman]

Website Baker Version 2.6.5 and before contains a SQL injection.
This can be exploited by using Cookie Poisoning

Manufacturer was notified, but want to ignore the request pending =
release version 3.0

Poison the cookie for the login page with the REMEMBER_KEY variable with =
a standard sql injection ('; <Insert Your SQL Statment here> --)

Failing function is in class.login.php=20
=A0=A0=A0=A0=A0 // Function to check if a user has been remembered
=A0=A0=A0=A0=A0 function is_remembered() {
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 if(isset($_COOKIE['REMEMBER_KEY']) AND =
$_COOKIE['REMEMBER_KEY'] !=3D '') {
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0 // Check if the =
remember key is correct
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0 $database =3D new =
database();
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0 $check_query =3D =
$database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE =
remember_key =3D '".$_COOKIE['REMEMBER_KEY']."' LIMIT 1");

This function is called by the login screen, hence the vulnerability.
When changing the user table... Free admin login :P

HotFix:=20
Change $database->query("SELECT user_id FROM ".$this->USERS_TABLE." =
WHERE remember_key =3D '".$_COOKIE['REMEMBER_KEY']."' LIMIT 1");=20
into=20
$database->query("SELECT user_id FROM ".$this->USERS_TABLE." WHERE =
remember_key =3D '".addslashes($_COOKIE['REMEMBER_KEY'])."' LIMIT 1");

$query_details =3D $database->query("SELECT * FROM =
".$this->USERS_TABLE." WHERE user_id =3D =
'".substr($_COOKIE['REMEMBER_KEY'], 0, 11)."' LIMIT 1");=20
into
$query_details =3D $database->query("SELECT * FROM =
".$this->USERS_TABLE." WHERE user_id =3D =
'".substr(addslashes($_COOKIE['REMEMBER_KEY']), 0, 11)."' LIMIT 1");=20

With Regards

Rolf Huisman