60CycleCMS – ‘news.php’ SQL Injection - 体验盒子

作者： Unkn0wn

日期： 2020-03-09

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/48177/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

# Exploit Title: 60CycleCMS- 'news.php' Multiple vulnerability

# Google Dork: N/A

# Date: 2020-02-10

# Exploit Author: Unkn0wn

# Vendor Homepage: http://davidvg.com/

# Software Link: https://www.opensourcecms.com/60cyclecms

# Version: 2.5.2

# Tested on: Ubuntu

# CVE : N/A

---------------------------------------------------------

SQL Injection vulnerability:

----------------------------

in file /common/lib.php Line 64 -73

*

function getCommentsLine($title)

{

$title = addslashes($title);

$query = "SELECT <code>timestamp</code> FROM <code>comments</code> WHERE entry_id= '$title'";

// query MySQL server

$result=mysql_query($query) or die("MySQL Query fail: $query");

$numComments = mysql_num_rows($result);

$encTitle = urlencode($title);

return '<a href="post.php?post=' . $encTitle . '#comments" >' . $numComments . ' comments</a>';

}

lib.php line 44:

*

$query = "SELECT <code>timestamp</code>,<code>author</code>,<code>text</code> FROM <code>comments</code> WHERE <code>entry_id</code> ='$title' ORDER BY <code>timestamp</code> ASC";

*

news.php line 3:

*

require 'common/lib.php';

*

Then in line 15 return query us:

*

$query = "SELECT MAX(<code>timestamp</code>) FROM `entries

*

http://127.0.0.1/news.php?title=$postName[SQL Injection]

----------------------------

Cross Site-Scripting vulnerability:

File news.php in line: 136-138 :

*

$ltsu = $_GET["ltsu"];

$etsu = $_GET["etsu"];

$post = $_GET["post"];

*

get payload us and printEnerty.php file in line 26-27:

*

<? echo '<a class="navLink" href="index.php?etsu=' . $etsu . '">Older ></a>';

<? echo '<a class="navLink" href="index.php?ltsu=' . 0 . '">Oldest >>|</a>';

*

print it for us!

http://127.0.0.1/index.php?etsu=[XSS Payloads]

http://127.0.0.1/index.php?ltsu=[XSS Payloads]

----------------------------------------------------------

# Contact : 0x9a@tuta.io

# Visit: https://t.me/l314XK205E

# @ 2010 - 2020

# Underground Researcher