Advanced Upload (PHP) Script Version 1.0.2 MySQL Injection Vulnerabilities
============================================================================




Discovered by N_A, N_A[at]tutanota.com
=======================================







Description
============

An advanced php uploading script with MANY advanced features. including: registration, upload, manage uploads with folder
and upload management, ...and MUCH MUCH more!!!


https://sourceforge.net/projects/adv-uploads





Vulnerabilities
================

Several SQL Injection vulnerabilites exist that allow direct injection into the MySQL database.


Files Effected
===============

login.php:


if($_GET['action'] == 'check')
{
//find the user
$result = mysql_query("SELECT * FROM loginphp WHERE Uname='{$_POST['Uname']}'")$
$row = mysql_fetch_array( $result ); //set $row to result




As we can see the vulnerable variable is 'Uname' which is passed to the database via the POST method completely unchecked.





forgotpass.php:


if($_GET['action'] == 'email')
{
$_Email = $_POST['Email'];
$result = mysql_query("SELECT * FROM loginphp
WHERE Email='" . $_Email . "'") or die(mysql_error()); 
$row = mysql_fetch_array( $result );



As we can see here the 'Email' variable is passed to the database completely unchecked via the POST method.







Email
======

Discovered by N_A
N_A[at]tutanota.com