Seditio Blind SQL Injection users.php
|
#7022 |
|
|
Kaan
User is:
Posts: 2772
Meslek: Serbest Meslek
Age: 43
|
?lgili Dosya Seditio SQL injection Yamas? Blind SQL Injection
system/core/users/users.inc.php yi a??n alttakini bulun. Kod: if ($f=='search' && mb_strlen($y)>1) { $sq = $y; $title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'"; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } elseif ($g>1) { $title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g); $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } elseif ($gm>1) { $title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm); $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id WHERE g.gru_groupid='$gm'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id WHERE g.gru_groupid='$gm' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } elseif (mb_strlen($f)==1) { if ($f=="_") { $title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'"; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } else { $f = strtoupper($f); $title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'"; $i = $f."%"; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } } elseif (substr($f, 0, 8)=='country_') { $cn = strtolower(substr($f, 8, 2)); $title .= $cfg['separator']." ".$L['Country']." '"; $title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'"; $cn_code = ($cn=='00') ? '' : $cn; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } elseif ($f=='all') { $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); if ($s=='maingrp') { $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); } else { $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); } } Alttakiyle de?i?tirin. Kod: if ($f=='search' && mb_strlen($y)>1) { $sq = $y; $title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'"; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } elseif ($g>1) { $title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g); $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } elseif ($gm>1) { $title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm); $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id WHERE g.gru_groupid='$gm'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id WHERE g.gru_groupid='$gm' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } elseif (mb_strlen($f)==1) { if ($f=="_") { $title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'"; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } else { $f = strtoupper($f); $title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'"; $i = $f."%"; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } } elseif (substr($f, 0, 8)=='country_') { $cn = strtolower(substr($f, 8, 2)); $title .= $cfg['separator']." ".$L['Country']." '"; $title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'"; $cn_code = ($cn=='00') ? '' : $cn; $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); $sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } elseif ($f=='all') { $sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1"); $totalusers = sed_sql_result($sql, 0, "COUNT(*)"); if ($s=='maingrp') { $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); } else { $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); } } Bu yama ge?ici olarak haz?rlanm??t?r Durumu Oliver'e bildirdim yak?n zamanda Ger?ek yamay? haz?rlayacakm??. Bu yama ilede her hangi bir sorun ya?amazs?n?z. son mesaj 9 dakika ?nce Blind SQL Injection Nas?l Yap?l?r: http://resources.infosecinstitut.....njection/ Bu mesaj Kaan tarafından 2012-03-07 22:34 GMT, 5191 Gün önce düzenlendi. |
Emlak, Oto Galeri, Rent A Car, ?iir, Edebiyat Script Sipari?lerinizi Verebilirsiniz. Detaylar ??in: kaan@ntka.org Seditio 170 ?ndir Capte M?zik ?ndir Seditio Toolbar ?ndir |













