PHPNews Auth.PHP SQL Injection Vulnerability

Bugtraq ID:	14333
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 20 2005 12:00AM
Updated:	Jul 20 2005 12:00AM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	PHPNews PHPNews 1.2.6 PHPNews PHPNews 1.2.5 PHPNews PHPNews 1.2.4 PHPNews PHPNews 1.2.3
Not Vulnerable:

PHPNews Auth.PHP SQL Injection Vulnerability

PHPNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

PHPNews Auth.PHP SQL Injection Vulnerability

An example of exploitation is as follows: (please note that magic_quotes_gpc must be set to 0 for this to succeed)

Navigate to the user logon form.

Enter the following string into the Username field:

anything' or '1'='1'/*

followed by any characters in the Password field.

PHPNews Auth.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPNews Auth.PHP SQL Injection Vulnerability

References:

• PHPNews Home Page (PHPNews)
  
• PHPNews SQL injection vulnerability ([email protected])
  
• Re: PHPNews SQL injection vulnerability (foster GHC )