sqlinjection bug in nova cms

# Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability
# Date: 2/12/2012
# Author: Dr.web
# Software Link: http://sourceforge.net/projects/xraycms/files/latest/download
# Version: 1.1.1
# Tested on: Ubuntu
XRay CMS is vulnerable to a SQL Injection attack which allows
authentication bypass into the admins account. If a malicious
user supplies ' or 1=1# into the applications user name field
they will be logged into the applications admin account.
Jan 29, 2012 ? Contacted Vendor No Response
Feb 05, 2012 ? Public Disclosure
Since the vendor did not reply we attempted to create our own
fixes for this issue. The vulnerability exist in ?login2.php?
on lines 20 and 21.
17 if(!isset($_POST['username'])) header("Location: login.php?error_username");
18 if(!isset($_POST['password'])) header("Location: login.php?error_password");
19
20 $user = $_POST['username'];
21 $pass = $_POST['password'];
If the lines 20 and 21 are changed to:
$user = mysql_real_escape_string($_POST['username']);
$pass = mysql_real_escape_string($_POST['password']);
This will prevent the sql injection from happening in the user name field.

Relevant Pages

  • [Full-disclosure] Invision Power Board <= 3.0.4 Local PHP File Inclusion and SQL Injection
    ... Invision Power Board <= 3.0.4 Local PHP File Inclusion and SQL Injection ... Invision Power Board (IPB) is a professional forum system that has ... LOCAL FILE INCLUSION VULNERABILITY ...
    (Full-Disclosure)
  • Re: sqlinjection bug in nova cms
    ... they will be logged into the applications admin account. ... Contacted Vendor No Response ... The vulnerability exist in ?login2.php? ... This will prevent the sql injection from happening in the user name field. ...
    (Bugtraq)
  • Invision Power Board <= 3.0.4 Local PHP File Inclusion and SQL Injection
    ... Invision Power Board <= 3.0.4 Local PHP File Inclusion and SQL Injection ... Invision Power Board (IPB) is a professional forum system that has been built ... LOCAL FILE INCLUSION VULNERABILITY ... It is possible to include an arbitrary php file stored on the server in any ...
    (Bugtraq)
  • Punbb <= 1.2.13 Multiple Vulnerabilities
    ... Type of vulnerability: SQL Injection and Local File Inclusion ... "PunBB is a fast and lightweight PHP powered discussion board. ...
    (Bugtraq)
  • Jupiter CMS 1.1.5 Multiple Vulnerabilities
    ... against SQL Injection attacks) in several SQL request. ... is that the script do not check for file extensions when a user upload ... Risk level: Medium ... simple poc illustrate how an attacker can exploit this vulnerability: ...
    (Bugtraq)