Total Users Online: 0 üye, 213 guest | Tarih/Saat: 2026-05-25 08:27
 
Cevap yaz Cevapla Yeni Konu A Yeni Konu Konuyu Yazdr Yazdr Konuyu E-Posta le Yolla Mail Yolla Seditio Blind SQL Injection users.php on Facebook Follow Seditio CMS on Twitter
Seditio Blind SQL Injection users.php
2012-03-07 19:56 GMT  oklu Alnt
M4ster
Seditio
Members
User is: Online status   Gender_M
Posts: 86
Ülke: İzmir - 35
Meslek: CodeR
Age: 39
Kaana ?zel mesajla bir yama ??karmas? i?in bildirdim kendisi yamay? yay?nlayacak, bundan ?nce Sql injectionun nas?l ?al??t???n? seditio severlere g?sterelim en az?ndan kaan ge?erli yamay? koyana dek sitelerinizi g?vende tutun

users.php?s=' sitenizin sonuna bu ?ekilde enterleyin sql hatas? verecektir, asl?nda bu a??k bir?ok exploit sitesinde yay?nland? ancak tam olarak kullan?m? a??klanmad? sadece Blind injection denilip ge?ildi pek dikkate al?nmad?, bu yolla sitenizin databasesine kolayl?kla ula?abiliyorlar, hay?rl? g?nler
Konuyla İlgili Diğer Başlıklar
Yeni Site Aktif Edildi. www.seditio.com.tr
Plugins Editör New Seditio 171
Seditio 171 Geliştirmesi.
Seditio
Seditio Eklenti Nasıl Kurulur Video

Bu mesaj Kaan tarafından 2012-04-12 17:16 GMT, 5155 Gün önce düzenlendi.
G?venlik dan??man? Seditio & Cotonti Manager
 

Seditio Blind SQL Injection users.php
2012-03-07 22:24 GMT  oklu Alnt
Kaan

Administrators
User is: Online status   Gender_M
Posts: 2772
Ülke: İstanbul - 34
Meslek: Serbest Meslek
Age: 43
?lgili Dosya Seditio SQL injection Yamas? Blind SQL Injection

system/core/users/users.inc.php yi a??n alttakini bulun.
Kod:
if ($f=='search' && mb_strlen($y)>1)
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_$s $w
LIMIT $d,".$cfg['maxusersperpage']);
}

elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
    else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
}

elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); }
}

Alttakiyle de?i?tirin.
Kod:
if ($f=='search' && mb_strlen($y)>1)
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_".$s." $w
LIMIT $d,".$cfg['maxusersperpage']);
}

elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
    else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
}

elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); }
}

Bu yama ge?ici olarak haz?rlanm??t?r Durumu Oliver'e bildirdim yak?n zamanda Ger?ek yamay? haz?rlayacakm??.
Bu yama ilede her hangi bir sorun ya?amazs?n?z.

son mesaj 9 dakika ?nce

Blind SQL Injection Nas?l Yap?l?r: http://resources.infosecinstitut.....njection/

Bu mesaj Kaan tarafından 2012-03-07 22:34 GMT, 5191 Gün önce düzenlendi.
Emlak, Oto Galeri, Rent A Car, ?iir, Edebiyat Script Sipari?lerinizi Verebilirsiniz.
Detaylar ??in: kaan@ntka.org

Seditio 170 ?ndir
Capte M?zik ?ndir
Seditio Toolbar ?ndir
 


Sayfa açılma süresi 0.025 sn.

1 [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ]
Powered by Seditio © 2009-2012 All Rights Reserved
Contact Us | Privacy Policy | Statistics | What's New | Top