full-disclosure - SQL Injection and PHP Code Injection Vulnerabilities in PHPKit 1.6.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <430A0D70.9040007@gmail.com>
Date: Tue Aug 23 02:19:18 2005
From: phuket.bugtraq at gmail.com (phuket)
Subject: SQL Injection and PHP Code Injection Vulnerabilities
	in PHPKit 1.6.1

SQL Injection and PHP Code Injection Vulnerabilities in PHPKit 1.6.1

Version: PHPKit 1.6.1
Risk: High if magic_quotes_gpc = Off
URL: http://www.phpkit.com

***************************************************************************

SQL Injection in include.php?path=login/member.php

The parameters usernick and letters are vulnerable to SQL Injections.
POC: 
/phpkit/include.php?path=login/member.php&letter=phuket'%20AND%20MID(user_pw,1,1)='8'/*

This will show the user "phuket" if the first character of his password 
hash is '8'.

SQL Injection in include.php?path=login/imcenter.php

The parameter im_receiver is vulnerable to SQL Injections.
POC: im_receiver=phuket' AND MID(user_pw,1,1)='8'/*

This will print an error message like "Der von Ihnen angegebene 
Empf?nger konnte nicht gefunden werden. ?berpr?fen Sie bitte Ihre Eingabe!"
If the first character of the password hash is not '8'.

PHP Code Injection in admin/admin.php?path=images.php

It is possible to upload .php files to the content/images/ directory.
Of course you need a legal admin pass first.

Exploit code exists but I will not make it available to the public at 
this time.

*******************************************************************************

Solution:
Turn magic_quotes on

Phuket