Re: Fwd: Re: Posible security bug in phpMyWebhosting

[Matias Neiff]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all.
I test the last version that I (and everybody) can find in the web.

http://sourceforge.net/projects/phpmywebhosting/

(the version 0.3.4)
Please try the bug whit this version.
I put this version of you panel in the page :=20
http://www.root-solutions.com.ar/pmwh/

Cheers

Matias Neiff
www.root-solutions.com.ar

> In-Reply-To:
> <200408141441.44157.matias@neiff.com.ar>
>
> Hi Matias,
>
> On Sat, 14 Aug 2004 14:41:42 -0300 you wrote:
> > Hi all.
> > There is a posible security bug in the
>
> phpMyWebhosting
>
> > (http://sourceforge.net/projects/phpmywebhosting/)
> >
> > File: includes/functions/pmwh.php
> > Function: test
> > [...]>Proof of concept: try using
> >
> > usr: admin"-(
> > pass: "asdfasdf
>
> I am the main developer of this piece of software
> and not amused that you didn't mail about this bug.
>
> But: I tried with actual version 0.4.0 (and also
> earlier version) and can't reproduce your security
> bug.
> If I enter your information I get a "Wrong password"
> message.
>
> Could you please explain this?
>
> Regards Udo M=FCller
> dev@PHPMyWebHosting
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBJcw1CRaMUNBLpxsRAvFgAKCRiKY4HBTpEBYncRwAnJ Yv9O4gfwCfaBDQ
zJ6erIlLOnNLXMAGjTg6nP0=3D
=3D9cdS
=2D----END PGP SIGNATURE-----

[Udo Mueller]

Hallo bugtraq,

* Udo Mueller schrieb [20-08-04 09:31]:
> begin * Daniel Souza schrieb [20-08-04 02:01]:
> >
> > may your server is configured with magic_quotes disabled, so, the " is not
> > slashed and we have a basic sql injection. Im not sure because I have not
> > seen the source codes to say that, but it's what looks like. Is there a
> > addslashes in the code ?
>
> In Debian magic_quotes = On is standard.
>
> I should add addslashes in the code. Thank you!

At our website https://sourceforge.net/project/showfiles.php?group_id=85616
is a patch for PHPMyWebHosting v0.3.4 available, which now reads the
login forms and makes some checks on the data and closes sql
injection at login screen.

Next release version will be 0.5.0 where all data is checked against
several mysql and php functions to avoid sql injection.

Regards Udo
--
PHPMyWebHosting main developer