bugtraq - Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 28 Sep 2007 07:20:59 -0000
From: gmdarkfig@...il.com
To: bugtraq@...urityfocus.com
Subject: Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel
 2.5.11

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5125
Same as mine:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1171

[me]
# +nsbypass.php
# 16. $tid = intval($tid);
# 17. if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) {
# 18. $abadmin = base64_decode($_COOKIE['admin']);
# 19. $abadmin = explode(":", $abadmin);
# 20. $a_aid = "$abadmin[0]";
# 21. $a_pas = "$abadmin[1]";
# 22. }
#....
# +nsbypass.php
# 24. $num = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_authors WHERE `aid`='$a_aid' AND `pwd`='$a_pas'"));
# 25. $tum = $db->sql_numrows($db->sql_query("SELECT * FROM
".$prefix."_nsnst_tracked_ips WHERE `tid`='$tid'"));
#

[you]
----------->[source code]<------------
if(isset($_COOKIE['admin']) && !empty($_COOKIE['admin'])) {
$abadmin = base64_decode($_COOKIE['admin']);
$abadmin = explode(":", $abadmin);
$a_aid = "$abadmin[0]";
$a_pas = "$abadmin[1]";
}
$num = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_authors
WHERE `aid`='$a_aid' AND `pwd`='$a_pas'"));
------------>[/source code]<-----------