PHPNews SQL injection vulnerability

[ghc@ghc.ru]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Product: PHPNews
Version: 1.2.5 Release, bugfix 1.2.6 (and previous)
URL: http://newsphp.sourceforge.net/
VULNERABILITY CLASS: SQL injection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[PRODUCT DESCRIPTION]
PHPNews is a popular script for news posting written in PHP (MySQL based).

[VULNERABILITY]

Vulnerable script: auth.php

else if(isset($_POST['user']) && isset($_POST['password']))
{
$in_user = $_POST['user'];         // <-- not filtered
$in_password = $_POST['password'];
}

$result = mysql_query('SELECT * FROM ' . $db_prefix . 'posters WHERE username = \'' . $in_user . '\' AND password = password(\'' . $in_password . '\')');
$dbQueries++;

if(mysql_numrows($result) != 0)
{
$auth = true;
$_SESSION['user'] = $in_user;
$_SESSION['password'] = $in_password;
}

In case magic_quotes_gpc=0, an attacker can inject SQL statements through $_POST['user'] parameter.

Example of exploitation:
In the login form type "whatever' or '1'='1'/*" in the "Username" field and
"whatever" in the "Password" field (without double quotes).
Or just use "admin'/*" as username (where "admin" - is real login name of administrator).

Possible scenario of attack. Attacker can:
[1] log in admin panel, using SQL injection
[2] upload PHP file through "Upload Images" function (index.php?action=images) and have fun with php shell
or edit template (index.php?action=modtemp) and put backdoor code into it.


[Bugfix]:

$in_user = $_POST['user'];

replace with:

if (!get_magic_quotes_gpc())  {$in_user=addslashes($_POST['user']);}
else {$in_user = $_POST['user']; }

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[CREDITS]
RST/GHC
http://www.ghc.ru
http://rst.void.ru
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[foster@ghc.ru]

by the way, to fix vulbnerability, you need to
addslashes() $_POST['password'] variable to.