Seditio Blind SQL Injection users.php

Author: M4ster, Posted: 2012-03-07 19:56 GMT. This post was edited by Kaan (2012-04-12 17:16 GMT, 5275 Gün ago)

Kaana ?zel mesajla bir yama ??karmas? i?in bildirdim kendisi yamay? yay?nlayacak, bundan ?nce Sql injectionun nas?l ?al??t???n? seditio severlere g?sterelim en az?ndan kaan ge?erli yamay? koyana dek sitelerinizi g?vende tutun

users.php?s=' sitenizin sonuna bu ?ekilde enterleyin sql hatas? verecektir, asl?nda bu a??k bir?ok exploit sitesinde yay?nland? ancak tam olarak kullan?m? a??klanmad? sadece Blind injection denilip ge?ildi pek dikkate al?nmad?, bu yolla sitenizin databasesine kolayl?kla ula?abiliyorlar, hay?rl? g?nler

Author: Kaan, Posted: 2012-03-07 22:24 GMT. This post was edited by Kaan (2012-03-07 22:34 GMT, 5311 Gün ago)

?lgili Dosya Seditio SQL injection Yamas? Blind SQL Injection

system/core/users/users.inc.php yi a??n alttakini bulun.

Kod:

if ($f=='search' && mb_strlen($y)>1)
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_$s $w
LIMIT $d,".$cfg['maxusersperpage']);
}

elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
}

elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); }
}

Alttakiyle de?i?tirin.

Kod:

if ($f=='search' && mb_strlen($y)>1)
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_".$s." $w
LIMIT $d,".$cfg['maxusersperpage']);
}

elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
}

elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}

elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); }
}

Bu yama ge?ici olarak haz?rlanm??t?r Durumu Oliver'e bildirdim yak?n zamanda Ger?ek yamay? haz?rlayacakm??.
Bu yama ilede her hangi bir sorun ya?amazs?n?z.

son mesaj 9 dakika ?nce

Blind SQL Injection Nas?l Yap?l?r: http://resources.infosecinstitut.....njection/