AutorankPHP Remote Exploit via SQL Injection
 

Software: AutorankPHP

Title: [FW-004] accounts.php remote login exploit via SQL Injection

Summary: Ability to remotely log in and change account information with minimal information about accounts

Description: Using a specially crafted username, one can log into a trade's account in AutorankPHP and change data including username, password, email account

Impact: Traffic can be redirected to other urls, account information changed

Workaround: Modify accounts.php and add

$_POST['Username'] = mysql_real_escape_string($_POST['Username']);
$_POST['Password'] = mysql_real_escape_string($_POST['Password']);

after the
References:
http://firewall.com/advisories/autorankphp.html

Risk Factor: Medium

http://secunia.com/advisories/10467/

Supposedly already found and fixed -- I guess that doesn't explain the extraordinarily high number of sites in google that are not patched (or a client that bought the software in March 2004 that was vulnerable)