vAuthenticate Remote SQL Injection Vulnerability

Bugtraq ID:	6605
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2003 12:00AM
Updated:	Jan 14 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to "Frog Man" <[email protected]>.
Vulnerable:	BeanBug vAuthenticate 2.8
Not Vulnerable:

vAuthenticate Remote SQL Injection Vulnerability

A vulnerability has been discovered in vAuthenticate. It has been reported that various PHP scripts used by vAuthenticate are prone to SQL injection attacks. This issue may be exploited by an unauthorized attacker to view protected web pages.

An attacker that is able to access protected web pages may gain sensitive information that may aid in launching further attacks against a target server.

vAuthenticate Remote SQL Injection Vulnerability

The following proof of concepts have been made available:

http://www.example.org/chgpwd.php?USERNAME=[username]&PASSWORD='%20OR%20''='
http://www.example.org/admin/index.php?USERNAME='%20OR%20''='&PASSWORD='%20OR%201=1%20AND%20level='1

vAuthenticate Remote SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

vAuthenticate Remote SQL Injection Vulnerability

References:

• phpsecure Home Page (phpsecure)
  
• vScripts Page (BeanBug)
  
• vSignup, vAuthenticate (PHP) ("Frog Man" )