deajan / pfsense-cp-auth-onestep

pfSense Captive portal self registration in one single step

pfSense Captive portal one step authentication solution

This script allows to use the captive portal without having to create a user account first. The user account gets created / updated on first login.

Features

• Integration with pfSense Captive Portal, MySQL and FreeRADIUS
• Full responsive template
• jQuery validation
• Server-side validation
• Language customization
• Separate user database for marketing needs
• Terms of use modal
• Nice error handling
• Debug mode

How-to

Full documentation is available here (see the HTML link for English doc) http://netpower.fr/pfcp-pfSense-auth-onestep

pfsense-cp-auth-onestep's Issues

Steps for remote radius server

Do you by chance have a few steps to integrate this into an external radius server? It would be so helpful.

Radius Error on form submit

Hi, i think there is a problem with the database insert.
When i click to the connect button, the registration form is back
In the system log of pfsense i can see this error :
(6) Invalid user (sql1 : Failed to create the pair: Invalid vendor name in attribute name "Password"): [[email protected]] (from client tester port 2000 cli xx:xx:xx:xx:xx:xx)
where xx is the mac address
And in the user database nothin is recorded

I use pfsense 2.4.3 so maybe your script isn't compatible.

The Instrutions does not work

I follow the step by step, but it is full of errors to put to wokr all in same box in a pfSense 2.4.4.p3
I separate the MySQL box to other machine, and the authentication log from the FreeRADIUS to the data base works, but when create the portal and do login on the ozy-asads.php page, give a full fatal errors the php some ones like mysqli not found in /var/etc/captiveportal_zonawifi.html:157 and a lot more of error, other error is login NULL and blah blah blah.
Some one can put to works easy this MOD ?

Thanks

SQL Injection

Unfortunately, your code is vulnerable to SQL Injections as the function "cleanInput($input)" is not sufficient for sanitizing SQL statements. For example, you are taking the familyName directly from the post parameter

$familyName = cleanInput($_POST["familyName"]);

which is later used in an SQL statement without any further validation:

$query = "UPDATE reg_users SET familyName = '$familyName', surName = '$surName', roomNumber = '$roomNumber' , ipAddress = '$ipAddress', regDate = '$regDate', identificator = '$identificator', newsletter = '$newsletter' WHERE macAddress = '$macAddress' AND emailAddress = '$emailAddress';";

In fact, I could exploit it with sqlmap:

sqlmap identified the following injection point(s) with a total of 4058 HTTP(s) requests:
---
Parameter: familyName (POST)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: [email protected]&familyName=Eisentraut' RLIKE (SELECT (CASE WHEN (6863=6863) THEN 0x456973656e7472617574 ELSE 0x28 END))-- KtQR&surName=Klaus&termsOfUse=termsOfUSe&connecter=Connect&connect=true
---

This can at least be used by an attacker to exfiltrate the names and email addresses of previous WiFi users from the database, so can you please use Prepared Statements? Thanks!