PHPPass 2 - 'AccessControl.php' SQL Injection

Author: frog
type: webapps
platform: php
port: 
date_added: 2003-01-13 
date_updated: 2012-10-21 
verified: 1 
codes: CVE-2003-1533;OSVDB-40591 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/6594/info

A problem with phpPass may allow an attacker to launch a SQL injection attack.

The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote user to inject arbitrary SQL into the database used by a vulnerable site. This may allow an attacker to view pages that would normally be restricted.

http://[target]/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''='