Application :- Land Down Under
=+++++++++++++++++++++++++=

http://ldu.neocrome.net/

Versions Affect: LDU 601 (other versions not checked)
Risk Factor - Undertimend
Impact - In the least, the attacker could gain access to a users account (unless logged in)
Type of Exploit - SQL Injection (auth.php)
Vendor Status: Vendor Notified
Date: 08 December, 2003
Credit: HelloWorld
Tested on a localhost, magic_quotes_goc off. Php 4.0.1

1) Introduction
2) The vulnerability
3) The exploit
4) The fix
5) Credit/Conclusion


1) Introduction

This php script is easily exploited. It comes in a form of an SQL injection, through the standard login form (auth.php) and from appearances,
 many other places. It appears the writer of the script is unaware of SQL injection vulnerability, or relies solely on magic_quote_gpc

The Vulnerability

Land Down Under lacks basic security for checking user inputted data. It makes no attempt to apply slashes to any of the incomming

Here is where the actual vulnerable code exists (comments added by me):
############### START HERE ############### 
// More code above
if ($a=="check")
	{
	ldu_shield_protect();

	$rusername = cv('rusername','P','TXT');
	$rpassword = cv('rpassword','P','TXT');
	$rmdpass  = md5($rpassword);
    $query="SELECT user_id, user_active, user_banned, user_banexpire, user_level, user_skin, user_lang FROM $db_users WHERE user_password='$rmdpass'
 AND user_name='$rusername'";

	$sql = ldu_mysql_query($query);
// Continues to validate.
################ END HERE ################ 


The Exploit

Using the form simply put in "' OR 1=1 -- " (without quotes). For a specific user, simply type "' OR user_name='USERNAME' -- " (without
 quotes)

The Fix

Wait vendor respounce. Basic solution would be to addslashes to the incoming data, or turn on magic_quotes.gpc via php ini. Most likely
 if magic_quotes_gpc is on.

Credit/Conclusion

Sorry for the badly formatted and poorly written document. Written as quick as the vulneribility was found, which wasn't long.  The
 package contains some nice features, and its skins are pleasant to the eye, but lacks the basic and vital security to enable it to
 be accessible via the public.

This vulnerability was discovered by HelloWorld 
email:
gdayworld 
hotmail 
com

Good Luck
HelloWorld.