Cant acces phpauction XL 2 admin area

Codewalkers Forums Sponsor:

January 28th, 2007, 03:36 AM

Anonymous

Registered User

Codewalkers God 35th Plane (22000 - 22499 posts)

Join Date: Apr 2007

Posts: 22,309

Time spent in forums: < 1 sec
Reputation Power: 25

Cant acces phpauction XL 2 admin area

I,

I have setup the phpauction xl 2 but seem that i cant connect to the admin area of phpauction.

Basicaly Evrytime i go to the admin area it askme to create a admin username and password, i have tryied loads of times and always the same screen. I went to my database to check if its writting something in the proper admin table and seems nothing is being iserted there.

I tried even to manualy to input the username and admin password but agan nothing.. it seems that the phpaucting uses a security algorithm calle md5_prefix that i cant understand..

If someone knows abouth this problem that can give me some light i would appreciate. I leave you with the login.php from admin area...

php Code:

Original - php Code

<?#//v.2.0.0
#///////////////////////////////////////////////////////
#// COPYRIGHT 2004 Phpauction.org ALL RIGHTS RESERVED//
#///////////////////////////////////////////////////////

session_name("PHPAUCTIONADMIN");

session_start();

require('../includes/messages.inc.php');
require('../includes/config.inc.php');

if($HTTP_POST_VARS[action] == "insert" && basename($HTTP_REFERER) == basename($PHP_SELF))
{
#// Additional security check
$RR = mysql_query("SELECT id from PHPAUCTIONXL_adminusers");
if(mysql_num_rows($RR) > 0)
{
print "Fatal error: user cannot be inserted - one or more administrators are already present in

the database.<BR><A HREF=login.php>login page</A>";
exit;
}
$md5_pass=md5($MD5_PREFIX.$password);
$query = "insert into PHPAUCTIONXL_adminusers values (10,'$username', '$md5_pass',

'20011224', '20020110093458', 1)";
$result = @mysql_query($query);
#// Redirect
Header("Location: admin.php");
exit;
}
$query = "select MAX(id) from PHPAUCTIONXL_adminusers";
$result = @mysql_query($query);
while($row = mysql_fetch_row($result))
{
$id = $row[0] + 1;
}
if($id==1)
{
$id=0;
require("./header.php"); ?>
<TABLE BORDER=0 WIDTH=650 CELLPADDING=0 CELLSPACING=0

BGCOLOR="#FFFFFF" ALIGN="CENTER">
<TR>
<TD><CENTER><FONT FACE="Verdana, Arial, Helvetica,

sans-serif" SIZE="4"><BR>
<BR>

<FORM NAME=login ACTION=login2.php METHOD=POST>
<TABLE WIDTH="410" BORDER="0" CELLSPACING="0"

CELLPADDING="1" BGCOLOR="#336699">
<TR>
<TD>
<TABLE WIDTH=100% CELLPADDING=3

ALIGN="CENTER" CELLSPACING="0" BORDER="0" BGCOLOR="#FFFFFF">
<TR BGCOLOR="#336699">
<TD COLSPAN="2"

ALIGN=CENTER><FONT FACE="Tahoma, Verdana" SIZE="2" COLOR="#FFFFFF"><B>
:: Please create

your username and password ::</B></FONT>
<? print "$pw=$md5_pass"; ?> 
</TD>
</TR>
<TR>
<TD></TD>
<TD> <FONT

FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2" COLOR=red>

<? print $ERR; ?>
</FONT>

</TD>
</TR>
<TR>
<TD ALIGN=right>

<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print

$MSG_003; ?>
</FONT>

</TD>
<TD>
<INPUT

TYPE=TEXT NAME=username SIZE=20 >
</TD>
</TR>
<TR>
<TD ALIGN=right>

<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print

$MSG_004; ?>
</FONT>

</TD>
<TD>
<INPUT

TYPE=password NAME=password SIZE=20 >
</TD>
</TR>
<TR>
<TD></TD>
<TD>
<INPUT

TYPE=submit NAME=action VALUE="insert">
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</FORM>
</font>
</CENTER>
</TD>
</TR>
</TABLE>

}
else { $id=1;
#//

if($HTTP_POST_VARS[action] == "login")

{

if(strlen($HTTP_POST_VARS[username]) == 0 ||

strlen($HTTP_POST_VARS[password]) == 0

)

{

$ERR = $ERR_047;

}

else

{

$query = "select * from PHPAUCTIONXL_adminusers where

username='$HTTP_POST_VARS[username]' and

password='".md5($MD5_PREFIX.$HTTP_POST_VARS[password])."'";

$res = @mysql_query($query);

if(!$res)

{

print "Error: $query<BR>".mysql_error();

exit;

}

if(mysql_num_rows($res) == 0)

{

$ERR = $ERR_048;

}

else

{

$admin = mysql_fetch_array($res);

#// Set sessions vars

$PHPAUCTION_ADMIN_LOGIN = $admin[id];

$PHPAUCTION_ADMIN_USER = $admin[username];

session_name("PHPAUCTIONADMIN");

session_register("PHPAUCTION_ADMIN_LOGIN","PHPAUCT ION_ADMIN_USER");

#// Update last login information for this user

$query = "update PHPAUCTIONXL_adminusers set

lastlogin='".date("YmdHis")."' where username='$admin[username]'";

$rr = mysql_query($query);

if(!$rr)

{

print "Error: $query<BR>".mysql_error();

exit;

}

#// Redirect

Header("Location: admin.php");

exit;

}

require("./header.php");

<TR>

<TD>

<BR>

<? if(!$action || ($action && $ERR)) : ?>

<TABLE WIDTH="415" BORDER="0" CELLSPACING="0"

CELLPADDING="1" BGCOLOR="#336699">

<TR>

<TD>

<TABLE WIDTH=100% CELLPADDING=4

ALIGN="CENTER" CELLSPACING="0" BORDER="0" BGCOLOR="#FFFFFF">

<TD COLSPAN="2"

ALIGN=CENTER><FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="1"

COLOR="#FFFFFF"><B>:: PLEASE LOG IN WITH THE USERNAME & PASSWORD YOU CREATED ::</B></FONT></TD>

</TR>

<TR>
<TD></TD>
<TD> <FONT

FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2" COLOR=red>
<? print "$md5_pass = md5($md5_prefix, password)"; ?> 
<? print $ERR; ?>
</FONT>

</TD>
</TR>
<TR>
<TD ALIGN=right>

<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print

$MSG_003; ?>
</FONT>

</TD>
<TD>
<INPUT

TYPE=TEXT NAME=username SIZE=20 >
</TD>
</TR>
<TR>
<TD ALIGN=right>

<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print

$MSG_004; ?>
</FONT>

</TD>
<TD>
<INPUT

TYPE=password NAME=password SIZE=20 >
</TD>
</TR>
<TR>
<TD></TD>
<TD>
<INPUT

TYPE=submit NAME=action VALUE="login">
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</FORM>
<? endif; ?>
</font>
</CENTER>
</TD>
</TR>
</TABLE>
<? } require("./footer.php"); ?>

 
<?#//v.2.0.0
#///////////////////////////////////////////////////////
#// COPYRIGHT 2004 Phpauction.org ALL RIGHTS RESERVED//
#///////////////////////////////////////////////////////
 
session_name("PHPAUCTIONADMIN");
 
session_start();
 
 
require('../includes/messages.inc.php');
require('../includes/config.inc.php');
 
if($HTTP_POST_VARS[action] == "insert" && basename($HTTP_REFERER) == basename($PHP_SELF))
{
#// Additional security check
$RR = mysql_query("SELECT id from PHPAUCTIONXL_adminusers");
if(mysql_num_rows($RR) > 0)
{
print "Fatal error: user cannot be inserted - one or more administrators are already present in 
the database.<BR><A HREF=login.php>login page</A>";
exit;
}
$md5_pass=md5($MD5_PREFIX.$password);
$query = "insert into PHPAUCTIONXL_adminusers values (10,'$username', '$md5_pass', 
'20011224', '20020110093458', 1)";
$result = @mysql_query($query);
#// Redirect
Header("Location: admin.php");
exit;
}
$query = "select MAX(id) from PHPAUCTIONXL_adminusers";
$result = @mysql_query($query);
while($row = mysql_fetch_row($result))
{
$id = $row[0] + 1;
}
if($id==1)
{
$id=0;
require("./header.php"); ?>
<TABLE BORDER=0 WIDTH=650 CELLPADDING=0 CELLSPACING=0 
 
BGCOLOR="#FFFFFF" ALIGN="CENTER">
<TR>
<TD><CENTER><FONT FACE="Verdana, Arial, Helvetica, 
sans-serif" SIZE="4"><BR>
<BR>
 
<FORM NAME=login ACTION=login2.php METHOD=POST>
<TABLE WIDTH="410" BORDER="0" CELLSPACING="0" 
 
CELLPADDING="1" BGCOLOR="#336699">
<TR>
<TD>
<TABLE WIDTH=100% CELLPADDING=3 
 
ALIGN="CENTER" CELLSPACING="0" BORDER="0" BGCOLOR="#FFFFFF">
<TR BGCOLOR="#336699">
<TD COLSPAN="2" 
 
ALIGN=CENTER><FONT FACE="Tahoma, Verdana" SIZE="2" COLOR="#FFFFFF"><B>
:: Please create 
 
your username and password ::</B></FONT>
<? print "$pw=$md5_pass"; ?> 
</TD>
</TR>
<TR>
<TD></TD>
<TD> <FONT 
 
FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2" COLOR=red>
 
 
 
<? print $ERR; ?>
</FONT> 
 
</TD>
</TR>
<TR>
<TD ALIGN=right> 
 
<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print 
 
$MSG_003; ?>
</FONT> 
 
</TD>
<TD>
<INPUT 
 
TYPE=TEXT NAME=username SIZE=20 >
</TD>
</TR>
<TR>
<TD ALIGN=right> 
 
<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print 
 
$MSG_004; ?>
</FONT> 
 
</TD>
<TD>
<INPUT 
 
TYPE=password NAME=password SIZE=20 >
</TD>
</TR>
<TR>
<TD></TD>
<TD>
<INPUT 
 
TYPE=submit NAME=action VALUE="insert">
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</FORM>
</font>
</CENTER>
</TD>
</TR>
</TABLE>
 
 
<?
 
}
else { $id=1;
#//
 
if($HTTP_POST_VARS[action] == "login")
 
{
 
if(strlen($HTTP_POST_VARS[username]) == 0 ||
 
strlen($HTTP_POST_VARS[password]) == 0
 
)
 
{
 
$ERR = $ERR_047;
 
}
 
else
 
{
 
$query = "select * from PHPAUCTIONXL_adminusers where 
username='$HTTP_POST_VARS[username]' and 
password='".md5($MD5_PREFIX.$HTTP_POST_VARS[password])."'";
 
$res = @mysql_query($query);
 
if(!$res)
 
{
 
print "Error: $query<BR>".mysql_error();
 
exit;
 
}
 
if(mysql_num_rows($res) == 0)
 
{
 
$ERR = $ERR_048;
 
}
 
else
 
{
 
$admin = mysql_fetch_array($res);
 
 
 
#// Set sessions vars
 
$PHPAUCTION_ADMIN_LOGIN = $admin[id];
 
$PHPAUCTION_ADMIN_USER = $admin[username];
 
session_name("PHPAUCTIONADMIN");
 
session_register("PHPAUCTION_ADMIN_LOGIN","PHPAUCT ION_ADMIN_USER");
 
 
 
#// Update last login information for this user
 
$query = "update PHPAUCTIONXL_adminusers set 
lastlogin='".date("YmdHis")."' where username='$admin[username]'";
 
$rr = mysql_query($query);
 
if(!$rr)
 
{
 
print "Error: $query<BR>".mysql_error();
 
exit;
 
}
 
 
 
#// Redirect
 
Header("Location: admin.php");
 
exit;
 
}
 
}
 
}
 
 
 
require("./header.php");
 
 
 
?>
 
 
 
<TABLE BORDER=0 WIDTH=650 CELLPADDING=0 CELLSPACING=0 BGCOLOR="#FFFFFF" ALIGN="CENTER">
 
<TR>
 
<TD>
 
<CENTER>
 
<FONT FACE="Verdana, Arial, Helvetica, sans-serif" SIZE="4"><BR>
 
<BR>
 
<? if(!$action || ($action && $ERR)) : ?>
 
<FORM NAME=login ACTION=login.php METHOD=POST>
 
<TABLE WIDTH="415" BORDER="0" CELLSPACING="0" 
 
CELLPADDING="1" BGCOLOR="#336699">
 
<TR>
 
<TD>
 
<TABLE WIDTH=100% CELLPADDING=4 
 
ALIGN="CENTER" CELLSPACING="0" BORDER="0" BGCOLOR="#FFFFFF">
 
<TR BGCOLOR="#33CC33">
 
<TD COLSPAN="2" 
 
ALIGN=CENTER><FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="1" 
 
COLOR="#FFFFFF"><B>:: PLEASE LOG IN WITH THE USERNAME & PASSWORD YOU CREATED ::</B></FONT></TD>
 
</TR>
 
<TR>
<TD></TD>
<TD> <FONT 
 
FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2" COLOR=red>
<? print "$md5_pass = md5($md5_prefix, password)"; ?> 
<? print $ERR; ?>
</FONT> 
 
</TD>
</TR>
<TR>
<TD ALIGN=right> 
 
<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print 
 
$MSG_003; ?>
</FONT> 
 
</TD>
<TD>
<INPUT 
 
TYPE=TEXT NAME=username SIZE=20 >
</TD>
</TR>
<TR>
<TD ALIGN=right> 
 
<FONT FACE="Verdana, Verdana, Arial, Helvetica, sans-serif" SIZE="2">
<? print 
 
$MSG_004; ?>
</FONT> 
 
</TD>
<TD>
<INPUT 
 
TYPE=password NAME=password SIZE=20 >
</TD>
</TR>
<TR>
<TD></TD>
<TD>
<INPUT 
 
TYPE=submit NAME=action VALUE="login">
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</FORM>
<? endif; ?>
</font>
</CENTER>
</TD>
</TR>
</TABLE>
<? } require("./footer.php"); ?>

Viewing: Codewalkers Forums > PHP Related > PHP Installation > Cant acces phpauction XL 2 admin area

« Previous Thread | Next Thread »

Thread Tools	Search this Thread
Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts vB code is On Smilies are On [IMG] code is On HTML code is Off

View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox

Forum Jump

Free IT White Papers!

Create the Optimal Architecture for your Critical Applications
Warburton's the largest independently owned bakery in the UK faced a number of difficult challenges in providing the most robust yet efficient IT infrastructure for their organization's success. IBM's services combined with their xSeries servers created the perfect platform for their SAP environment with sufficient flexibility, and did so in very time effective fashion.
Request Your Free Technology Downloads!

Five Best Practices for Deploying a Successful Service-Oriented Architecture
This white paper describes the benefits you can expect with SOA, and how IBM can help take your business there.
Request Your Free Technology Downloads!

Gartner Magic Quadrant for Application Delivery Controllers
Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses of solutions, and provides Magic Quadrant reporting for a quick comparison across all vendors. Learn from Gartner how you can benefit from an all-in-one device like Citrix NetScaler that delivers the highest levels of availability, performance and security.
Request Your Free Technology Downloads!

Knowledge is Power
What you don't know can hurt you, and is likely costing you money and increasing your security risks during an era of scarce resources. This white paper proposes six key strategies that enterprise security managers can use to improve their network defense posture.
Request Your Free Technology Downloads!

Rationalizing the Multi-Tool Environment
The rationalized multi-tool approach is flexible, scalable and cost effective. It provides the necessary input to the IT service management business processes. It preserves prior investments in monitoring tools, empowers technologists to select the best tools with which to do their jobs, and enhances effective response to incidents.
Request Your Free Technology Downloads!

More Free IT White Papers!