AutoRank PHP is "our next generation toplist software, written completely in PHP and backed by a MySQL database". AutoRank PHP is vulnerable to SQL Injection attacks.
Credit:
The information has been provided by JeiAr.
The vulnerabilities can be exploited by injecting SQL queries into the user & password fields when editing an account, the email field when requesting a lost password and the username field when registering an account. If a malicious attacker logs in with the username and password '-- he will automatically be given access to the first account cataloged in the database. He can then view the HTML source code to view that user's password in plain text. This also leaves the database being used by AutoRank PHP open for attack. The affected file is accounts.php.
