Originally hosted at dmcdonald.net/?page_id=51 and posted to Packet Storm. Archived here on dmcdonald.net 2026-05-19, reproduced from the Wayback Machine capture of 6 February 2012 with light typo fixes. original archive.
Background
"The aim of Pro Clan Manager is to create an international content management system dedicated to helping Clans or Guilds work together and have a good looking website that is W3C valid." [1]
Both of the listed issues can allow unauthenticated users with zero knowledge to gain administrative access to the application. This includes permissions to upload arbitrary files such as PHP scripts.
CVE numbers
- SQL Injection: CVE-2011-4556
- Poor Random Password Generation: CVE-2011-4557
Versions
Version 1.4.2 was tested. The author has decided to officially discontinue the project in response to these issues. Users should uninstall the software as soon as possible, before finding a replacement.
Finding 1: SQL Injection
Description
The application performs input validation using the $post->Text method throughout the application on strings to be used in dynamic query construction. These fields do not appear to be vulnerable to SQL injection.
However, the $post->LoginFilter uses eregi to ensure non-alphanumeric characters are not present in the login field. eregi expects a C-style null-terminated string and will not proceed beyond the first null byte it encounters. By prefixing a SQL injection attack string with a null byte, this filtering can be bypassed.
The following attack string can be used in the login field to access the system as the administrator:
notarealuser%00'+union+select+1;#
This needs to be entered as raw HTTP.
Finding 2: Poor Random Password Generation
Description
Line 302 in includes/user.php generates passwords for new users and for users which have their passwords reset by an administrator:
$password = substr(md5(rand(10000,99999)), 5, 8);
While the passwords generated by this code appear random, it is fairly obvious from the snippet above that this code is only capable of generating a maximum of 90,000 unique passwords.
A list of these passwords can be easily constructed, which when used during an automated attack took around 15 minutes on average to successfully guess a random password.
The complete candidate list is produced by the following script:
<?php
for( $i = 10000; $i < 99999; $i++ )
{
echo substr(md5($i),5,8) . "<br/>";
}
?>
References
[1] Pro Clan Manager SourceForge Page, http://sourceforge.net/projects/autoweb/, Accessed 2011-11-19.