Are there any security vulnerabilities in this PHP code?
- by skorned
Hi. I just got a site to manage, but am not too sure about the code the previous guy wrote. I'm pasting the login procedure below, could you have a look and tell me if there are any security vulnerabilities? At first glance, it seems like one could get in through SQL injection or manipulating cookies and the ?m= parameter.
define ( 'CURRENT_TIME', time ()); / / Current time.
define ( 'ONLINE_TIME_MIN', (CURRENT_TIME - BOTNET_TIMEOUT)); / / Minimum time for the status of "Online".
define ( 'DEFAULT_LANGUAGE', 'en'); / / Default language.
define ( 'THEME_PATH', 'theme'); / / folder for the theme.
/ / HTTP requests.
define ( 'QUERY_SCRIPT', basename ($ _SERVER [ 'PHP_SELF']));
define ( 'QUERY_SCRIPT_HTML', QUERY_SCRIPT);
define ( 'QUERY_VAR_MODULE', 'm'); / / variable contains the current module.
define ( 'QUERY_STRING_BLANK', QUERY_SCRIPT. '? m ='); / / An empty query string.
define ( 'QUERY_STRING_BLANK_HTML', QUERY_SCRIPT_HTML. '? m ='); / / Empty query string in HTML.
define ( 'CP_HTTP_ROOT', str_replace ( '\ \', '/', (! empty ($ _SERVER [ 'SCRIPT_NAME'])? dirname ($ _SERVER [ 'SCRIPT_NAME']):'/'))); / / root of CP.
/ / The session cookie.
define ( 'COOKIE_USER', 'p'); / / Username in the cookies.
define ( 'COOKIE_PASS', 'u'); / / user password in the cookies.
define ( 'COOKIE_LIVETIME', CURRENT_TIME + 2592000) / / Lifetime cookies.
define ( 'COOKIE_SESSION', 'ref'); / / variable to store the session.
define ( 'SESSION_LIVETIME', CURRENT_TIME + 1300) / / Lifetime of the session.
////////////////////////////////////////////////// /////////////////////////////
/ / Initialize.
////////////////////////////////////////////////// /////////////////////////////
/ / Connect to the database.
if (! ConnectToDB ()) die (mysql_error_ex ());
/ / Connecting topic.
require_once (THEME_PATH. '/ index.php');
/ / Manage login.
if (! empty ($ _GET [QUERY_VAR_MODULE]))
(
/ / Login form.
if (strcmp ($ _GET [QUERY_VAR_MODULE], 'login') === 0)
(
UnlockSessionAndDestroyAllCokies ();
if (isset ($ _POST [ 'user']) & & isset ($ _POST [ 'pass']))
(
$ user = $ _POST [ 'user'];
$ pass = md5 ($ _POST [ 'pass']);
/ / Check login.
if (@ mysql_query ( "SELECT id FROM cp_users WHERE name = '". addslashes ($ user). "' AND pass = '". addslashes ($ pass). "' AND flag_enabled = '1 'LIMIT 1") & & @ mysql_affected_rows () == 1)
(
if (isset ($ _POST [ 'remember']) & & $ _POST [ 'remember'] == 1)
(
setcookie (COOKIE_USER, md5 ($ user), COOKIE_LIVETIME, CP_HTTP_ROOT);
setcookie (COOKIE_PASS, $ pass, COOKIE_LIVETIME, CP_HTTP_ROOT);
)
LockSession ();
$ _SESSION [ 'Name'] = $ user;
$ _SESSION [ 'Pass'] = $ pass;
/ / UnlockSession ();
header ( 'Location:'. QUERY_STRING_BLANK. 'home');
)
else ShowLoginForm (true);
die ();
)
ShowLoginForm (false);
die ();
)
/ / Output
if (strcmp ($ _GET [ 'm'], 'logout') === 0)
(
UnlockSessionAndDestroyAllCokies ();
header ( 'Location:'. QUERY_STRING_BLANK. 'login');
die ();
)
)
////////////////////////////////////////////////// /////////////////////////////
/ / Check the login data.
////////////////////////////////////////////////// /////////////////////////////
$ logined = 0, / / flag means, we zalogininy.
/ / Log in session.
LockSession ();
if (! empty ($ _SESSION [ 'name']) & &! empty ($ _SESSION [ 'pass']))
(
if (($ r = @ mysql_query ( "SELECT * FROM cp_users WHERE name = '". addslashes ($ _SESSION [' name'])."' AND pass = ' ". addslashes ($ _SESSION [' pass']). " 'AND flag_enabled = '1' LIMIT 1 ")))$ logined = @ mysql_affected_rows ();
)
/ / Login through cookies.
if ($ logined! == 1 & &! empty ($ _COOKIE [COOKIE_USER]) & &! empty ($ _COOKIE [COOKIE_PASS]))
(
if (($ r = @ mysql_query ( "SELECT * FROM cp_users WHERE MD5 (name )='". addslashes ($ _COOKIE [COOKIE_USER ])."' AND pass = '". addslashes ($ _COOKIE [COOKIE_PASS]). " 'AND flag_enabled = '1' LIMIT 1 ")))$ logined = @ mysql_affected_rows ();
)
/ / Unable to login.
if ($ logined! == 1)
(
UnlockSessionAndDestroyAllCokies ();
header ( 'Location:'. QUERY_STRING_BLANK. 'login');
die ();
)
/ / Get the user data.
$ _USER_DATA = @ Mysql_fetch_assoc ($ r);
if ($ _USER_DATA === false) die (mysql_error_ex ());
$ _SESSION [ 'Name'] = $ _USER_DATA [ 'name'];
$ _SESSION [ 'Pass'] = $ _USER_DATA [ 'pass'];
/ / Connecting language.
if (@ strlen ($ _USER_DATA [ 'language'])! = 2 | |! SafePath ($ _USER_DATA [ 'language']) | |! file_exists ( 'system / lng .'.$_ USER_DATA [' language '].' . php'))$_ USER_DATA [ 'language'] = DEFAULT_LANGUAGE;
require_once ( 'system / lng .'.$_ USER_DATA [' language'].'. php ');
UnlockSession ();
