发布 2015-12-15 漏洞条目

ArticleSetup Article Script 1.00 – SQL Injection

Exploit Source

########################################################################################

#______________________________________________________________________________________

# Exploit Title : Article Script SQL Injection Vulnerability

# Exploit Author : Linux Zone Research Team

# Vendor Homepage: http://articlesetup.com/

# Google Dork : inurl:/article.php?id= intext:Powered By Article Marketing

# Software Link : http://www.ArticleSetup.com/downloads/ArticleSetup-Latest.zip

# Date : 15-December-2015

# Version : (Version 1.00)

# CVE : NONE

# Tested On : Linux - Chrome

# Category : Web Application

# MY HOME : http://linux-zone.org/Forums - research@linux-zone.org

#______________________________________________________________________________________

#######################################################################################

# localHost/article.php?id=SQL

#______________________________________________________________________________________

## Vulnerability Code

<?php

include('config.php');

//Create site settings variables

$sitequery = 'select * from settings;';

$siteresult = mysql_query($sitequery,$connection) or die(mysql_error());

$siteinfo = mysql_fetch_array($siteresult);

$siteurl = $siteinfo['url'];

$article = $_GET['id'];

if (!is_numeric($article)) {

header('Location: '.$siteurl);

}

else

{

$sitequery = 'select * from settings;';

$siteresult = mysql_query($sitequery,$connection) or die(mysql_error());

//Create site settings variables

$siteinfo = mysql_fetch_array($siteresult);

$sitetitle = $siteinfo['title'];

$siteurl = $siteinfo['url'];

$sitecomments = $siteinfo['comments'];

$commentmod = $siteinfo['commentmod'];

$query = "select * from articles where status=0 and id = ".$article;

$articleresults = mysql_query($query,$connection) or die(mysql_error());

$num_results = mysql_num_rows($articleresults);

$articleinfo = mysql_fetch_array($articleresults);

if (!$num_results) {

header('Location: '.$siteurl);

}

//Get article info

$id = $articleinfo['id'];

$authorid = $articleinfo['authorid'];

$date = strtotime($articleinfo['date']);

$artdate = date('m/d/y', $date);

$categoryid = $articleinfo['categoryid'];

$title = stripslashes($articleinfo['title']);

$body = stripslashes($articleinfo['body']);

$resource = $articleinfo['resource'];

//Meta Info

$cathead = 0;

$metatitle = $title." - ";

include('header.php');

include('sidebar.php');

if ($seourls == 1) { $scrubtitle = generate_seo_link($title); }

// Setup the article template

$articletemp = new Template("templates/".$template."/article.tpl");

// get author info

$authorquery = "select * from authors where id=".$authorid;

$authorresult = mysql_query($authorquery,$connection) or die(mysql_error());

$authorinfo = mysql_fetch_array($authorresult);

$authorname = $authorinfo['displayname'];

$authorbio = $authorinfo['bio'];

$gravatar = $authorinfo['gravatar'];

if ($seourls == 1) { $scrubauthor = generate_seo_link($authorname); }

// get category info

$catquery = "select * from categories where id=".$categoryid;

$catresult = mysql_query($catquery,$connection) or die(mysql_error());

$catinfo = mysql_fetch_array($catresult);

$categoryname = $catinfo['name'];

$catparent = $catinfo['parentid'];

if ($seourls == 1) { $scrubcatname = generate_seo_link($categoryname); }

// if the category doesn't have a parent

if ($catparent == NULL) {

if ($seourls == 1) { // With SEO URLS

$displaycat = "<a href=\"".$siteurl."/category/".$categoryid."/"

.$scrubcatname."/\">".$categoryname."</a>";

} else {

$displaycat = "<a href=\"".$siteurl."/category.php?id=".$categoryid

."\">".$categoryname."</a>";

}

// if the category DOES have a parent

} else {

$query = "select * from categories where id=".$catparent;

$result = mysql_query($query,$connection) or die(mysql_error());

$info = mysql_fetch_array($result);

$parentname = $info['name'];

if ($seourls == 1) { $scrubparent = generate_seo_link($parentname); }

if ($seourls == 1) { // With SEO URLS

$displaycat = "<a href=\"".$siteurl."/category/".$catparent."/"

.$scrubparent."/\">".$parentname."</a> >

<a href=\"".$siteurl."/category/".$categoryid."/"

.$scrubcatname."/\">".$categoryname."</a>";

} else {

$displaycat = "<a href=\"".$siteurl."/category.php?id=".$catparent

."\">".$parentname."</a> >

<a href=\"".$siteurl."/category.php?id=".$categoryid

."\">".$categoryname."</a>";

}

// Add a view to this article

$query = "select * from articleviews where articleid = ".$article;

$results = mysql_query($query,$connection) or die(mysql_error());

$viewinfo = mysql_fetch_array($results);

if ($viewinfo == NULL) {

$sql = "INSERT INTO articleviews VALUES (".$article.", 1)";

$query = mysql_query($sql);

} else {

$totalviews = $viewinfo['views'];

$totalviews++;

$sql = "UPDATE articleviews SET views=".$totalviews." WHERE `articleid`=".$article."";

$query = mysql_query($sql);

}

if ($seourls == 1) { // With SEO URLS

$authorlink = "<a href=\"".$siteurl."/profile/".$authorid."/".$scrubauthor."/\">".$authorname."</a>";

} else {

$authorlink = "<a href=\"".$siteurl."/profile.php?a=".$authorid."\">".$authorname."</a>";

}

// Setup all template variables for display

$articletemp->set("authorname", $authorname);

$articletemp->set("authorlink", $authorlink);

$articletemp->set("date", $artdate);

$articletemp->set("displaycat", $displaycat);

$articletemp->set("views", $totalviews);

$articletemp->set("title", $title);

$articletemp->set("body", $body);

$articletemp->set("gravatar", $gravatar);

$articletemp->set("resource", $resource);

// For the adcode

$query = "select * from adboxes where id=1;";

$result = mysql_query($query,$connection) or die(mysql_error());

$info = mysql_fetch_assoc($result);

$articletemp->set("250adcode", stripslashes($info['adcode']));

// Outputs the homepage template!

echo $articletemp->output();

//Displays the comments -- if admin has them enabled

if($sitecomments == 0) {

echo " <h2>Comments</h2>";

require_once 'comments/classes/Comments.class.php';

/* Article ID which shows the comments */

$post_id = $article;

/* Level of hierarchy comments. Infinit if declared NULL */

$level = NULL;

/* Number of Supercomments (level 0) to display per page */

$supercomments_per_page = 10000;

/* Moderate comments? */

if ($commentmod == 0) {

$moderation = true;

} else {

$moderation = false;

}

# Setup db config array #

$db_config = array("db_name" => $db_name,

"db_user" => $dbusername,

"db_pass" => $dbpassword,

"db_host" => $server );

# Create Object of class comments

$comments = new Comments($post_id, $level, $supercomments_per_page, $moderation, $db_config);

# Display comments #

echo $comments->getComments();

}

include('rightsidebar.php');

include('obinclude.php');

}

#######################################

# Hassan Shakeri - Mohammad Habili

# Twitter : @ShakeriHassan - Fb.com/General.BlackHat

##########################################################

作者: Linux Zone Research Team
日期: 2015-12-15
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection