phpPass AccessControl.PHP SQL Injection Vulnerability

Bugtraq ID:	6594
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 13 2003 12:00AM
Updated:	Jan 13 2003 12:00AM
Credit:	Discovery credited to "Frog Man" <[email protected]>.
Vulnerable:	phpPass phpPass 2
Not Vulnerable:

phpPass AccessControl.PHP SQL Injection Vulnerability

A problem with phpPass may allow an attacker to launch a SQL injection attack.

The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote user to inject arbitrary SQL into the database used by a vulnerable site. This may allow an attacker to view pages that would normally be restricted.

phpPass AccessControl.PHP SQL Injection Vulnerability

The following proof of concept was provided:

http://[target]/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''='

phpPass AccessControl.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

phpPass AccessControl.PHP SQL Injection Vulnerability

References:

• phpPass - phpsecure (frog-m@n)
  
• phpPass (PHP) ("Frog Man" )