Auth.class.php security hole

[Oxymoron290]

Function - ProcessLogin($useridoremail, $password) Lines - 256 through 258

$emailaddress = DB::escape($useridoremail);
                                $sql = 'SELECT * FROM ' . TABLE_PREFIX . 'pilots
                                                WHERE email=\''.$useridoremail.'\'';

Warning: $emailaddress is unused in this scope. Warning: no protection for variable $useridoremail in query $sql.

Suggested fix: Change the value of $sql to the following:

$sql = 'SELECT * FROM ' . TABLE_PREFIX . 'pilots
                        WHERE email=\'' . $emailaddress . '\'';

[equinoxmatt]

It isn't really an issue. It should be fixed, but no security hole as the password is checked separately.

i.e in the login, I can enter: security@phpvms.com OR 'x'='x

This would then throw an error saying I have entered the wrong password. This means my SQL injection has been succesful. I have returned some data. I have no way of exploiting this though as the password field is protected.

I do agree though, it needs to be fixed.

[equinoxmatt]

ok I take it back, I just exploited my local copy. This is now urgent

[Oxymoron290]

Yay! I helped!