PHP-Blog-Admin icon indicating copy to clipboard operation
PHP-Blog-Admin copied to clipboard

Remove unused file that contains SQL injection

Open RobTheFiveNine opened this issue 3 years ago • 0 comments

There is an unused file found in admin/functions/login.php. Within this file, however, is an SQL injection that can be used to bypass authentication and login as any admin user.

To see this working, create the following HTML file, replace the URL with your installation and hit the "Login" button, and you will be authenticated as the first admin user in the database:

<form method="post" action="http://10.2.0.132/admin/functions/login.php">
  <input type="text" value="[email protected]" name="email" />
  <input type="text" value="' or 'a'='a" name="password" />
  <input type="submit" value="Login" />
</form>

This pull request removes this file due to it no longer being in use and posing a security risk.

RobTheFiveNine avatar Oct 02 '21 12:10 RobTheFiveNine