######################################################################################
######################################################################################
Virangar Security Team
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra
& all virangar members & all hackerz
.::::admin Authentication bypass vuln::::.
//vuln code in login.php:
…
…
…
line 29:
$passwd = md5($_POST[userPassword]); // md5 hash password
if($_POST[userType] != 'Staff')
{$sql = "SELECT userID, userName
FROM user_account
WHERE userAccount='$_POST[userAccount]' AND
userPassword='$passwd' AND
userType='$_POST[userType]' AND isApproved='1'";
}else
$sql = "SELECT staffID, staffName, staffGroupID
FROM staff
WHERE staffAccount='$_POST[userAccount]' AND
staffPassword='$passwd'";
…