SQL Injection in lgin.htm

[Ali-Albakara]

As lgin.htm tries to grab the user's IP, it prioritizes HTTP_X_FORWARDED_FOR before REMOTE_ADDR. REMOTE_ADDR can be trusted not to be manipulated by the user however HTTP_X_FORWARDED_FOR is very easily manipulated. It needs validation of being a valid IP address. Look into filter_var()

[Ali-Albakara]

Same issue is present in reg.html

[Ali-Albakara]

More SQL Injection in reg.html

$sql = "INSERT INTO accounts(username,email,password,regip,reghash) VALUES('".$_REQUEST['username']."', '".$_REQUEST['email']."', '$encpass', '$ip', '$reghash')";

$_REQUEST['username'] is not sanitized nor validated

[booth-f]

Status Update: Fixed in dev source (Awaiting Push)

[booth-f]

A CVE was assigned for this issue:
CVE-2017-1000444