ASP.NET website hacked -> login problem
<p>I have a problem with my ASP.NET website, it got hacked. One hacker found a bug in my login system and he can login with every account he wants, even if the account is normal user, moderator or administrator. He can delete everything he wants. </p>

<p>Please can anyone help me, tell me if there is any vulnerable function or something</p>

<p>P.S. I'm not myself an ASP.NET programmer, I know only PHP, so please tell me exactly what I need to edit in the code, because I don't know ASP.NET at all.</p>

<p>ThanksAS</p>

<pre><code>    public void loginButton_Click(object sender, EventArgs e)
{
    string username = nicknameTextBox.Text;
    string password = passwordTextBox.Text;

    string returnUrl = Request.QueryString["returnUrl"];
    if (returnUrl == null) returnUrl = Convert.ToBase64String(Encoding.ASCII.GetBytes(Request.Url.ToString()));

    string message = CurrentPlayer.LoginRequest(username, password, returnUrl);

    if(message != null)
        Response.Redirect("AccountLogin.aspx?returnUrl=" + returnUrl);
}
</code></pre>

<p>LoginRequest:</p>

<pre><code>public static string LoginRequest(string username, string password, string returnUrl)
{
    Player player = null;
    string message = InputValidator.CheckLoginRequest(username, password, out player);
    if (message != null) return message;

    message = LoginCookie.CheckLoginRequest(player);
    if (message != null) return message;

    SessionPlayer sessionPlayer = new SessionPlayer(
            player.ID, player.ActivationGuid, (PlayerRole)player.IdRole, 
            player.Nickname, player.CreationDate);        
    SessionMessages sessionMessages = new SessionMessages(player.ID);
    SessionOwnedCounts ownedCounts = new SessionOwnedCounts(player.ID);
    SessionGuestCounts guestCounts = new SessionGuestCounts(player.ID);
    SessionMatchCounts matchCounts = new SessionMatchCounts(player.ID);

    CurrentPlayer.Login(sessionPlayer, sessionMessages, ownedCounts, guestCounts, matchCounts);
    Player.UpdateLastLogin(player.ID);

    returnUrl = Encoding.ASCII.GetString(Convert.FromBase64String(returnUrl));
    HttpContext.Current.Response.Redirect(returnUrl);

    return null;
}[/code]
</code></pre>

<p>Login:</p>

<pre><code>     private static void Login(SessionPlayer player, SessionMessages messages, SessionOwnedCounts ownedCounts, SessionGuestCounts guestCounts, SessionMatchCounts matchCounts)
{
    HttpContext.Current.Session["player"] = player;
    HttpContext.Current.Session["messages"] = messages;
    HttpContext.Current.Session["ownedCounts"] = ownedCounts;
    HttpContext.Current.Session["guestCounts"] = guestCounts;
    HttpContext.Current.Session["matchCounts"] = matchCounts;
    if (LoginCookie.Exists() == false)
        LoginCookie.AddForFirstTime(player.Nickname, player.Guid);
    else
        LoginCookie.SetToLoginAction();
}
</code></pre>

<p>And checkloginrequest:</p>

<pre><code>    public static string CheckLoginRequest(string username, string password, out Player player)
{
    player = null;

    object lastLoginTryDateObj = HttpContext.Current.Session["lastLoginTryDate"];
    if (lastLoginTryDateObj == null)
    {
        HttpContext.Current.Session["lastLoginTryDate"] = DateTime.Now;
        HttpContext.Current.Session["lastLoginTryCount"] = 1;
    }
    else
    {
        DateTime lastLoginTryDate = (DateTime)HttpContext.Current.Session["lastLoginTryDate"];
        int lastLoginTryCount = (int)HttpContext.Current.Session["lastLoginTryCount"];
        TimeSpan ts = DateTime.Now - lastLoginTryDate;
        if (ts.TotalSeconds &lt; 60)
        {
            if (lastLoginTryCount &gt;= Settings.AllowedLoginTriesPerMinute)
            {
                return "Ai depasit numarul maxim de incercari pe minut .&lt;br/&gt;Vino inapoi dupa " + (60 - (int)ts.TotalSeconds).ToString() + " secunde.";
            }
            else
            {
                HttpContext.Current.Session["lastLoginTryCount"] = lastLoginTryCount + 1;
            }
        }
        else
        {
            HttpContext.Current.Session["lastLoginTryDate"] = DateTime.Now;
            HttpContext.Current.Session["lastLoginTryCount"] = 1;
        }
    }

    player = Player.GetPlayer(username, password);
    if (player == null)
    {
        return "Usernameul si parola nu se potrivesc.";
    }
    if (player != null &amp;&amp; player.IsActive == false)
    {
        return "Contul a fost creat dar nu e activat.&lt;br/&gt; Verifica mailul " + player.Email + " si activeaza-ti contul.";
    }

    PlayerSuspended ps = BLL.PlayerSuspended.SuspendedGet(player.ID);
    if (ps != null)
    {
        return "Contul tau e suspendat pana in data de " + ps.SuspendedEndDate.ToString("dd-MM-yyyy") + ".&lt;br/&gt;Motivul: " + ps.SuspendedReason;
    }

    return null;
}
</code></pre>

<p>GetPlayer:</p>

<pre><code>     public static Player GetPlayer(string nickname, string password)
    {
        Player player = null;
        object[] values = DAL.Player.GetPlayer(nickname, password);

        if (values != null)
        {
            player = new Player();
            player.SetFromValues(values);
        }

        return player;
    }
</code></pre>

<p>DAL.Player.GetPlayer:</p>

<pre><code>    public static object[] GetPlayer(string nickname, string password)
    {
        password = Convert.ToBase64String(Encoding.ASCII.GetBytes(password));

        List&lt;SqlParameter&gt; sqlParams = new List&lt;SqlParameter&gt;();
        sqlParams.Add(new SqlParameter("@Nickname", nickname));
        sqlParams.Add(new SqlParameter("@Password", password));

        return DataBase.GetFirstRow("[spPlayer.Get]", sqlParams);
    }
</code></pre>
