M4ster - 2012-03-07 19:56 GMT -
Kaana ?zel mesajla bir yama ??karmas? i?in bildirdim kendisi yamay? yay?nlayacak, bundan ?nce Sql injectionun nas?l ?al??t???n? seditio severlere g?sterelim en az?ndan kaan ge?erli yamay? koyana dek sitelerinizi g?vende tutun
users.php?s=' sitenizin sonuna bu ?ekilde enterleyin sql hatas? verecektir, asl?nda bu a??k bir?ok exploit sitesinde yay?nland? ancak tam olarak kullan?m? a??klanmad? sadece Blind injection denilip ge?ildi pek dikkate al?nmad?, bu yolla sitenizin databasesine kolayl?kla ula?abiliyorlar, hay?rl? g?nler
Bu mesaj Kaan tarafından 2012-04-12 17:16 GMT, 5324 Gün önce düzenlendi.
Kaana ?zel mesajla bir yama ??karmas? i?in bildirdim kendisi yamay? yay?nlayacak, bundan ?nce Sql injectionun nas?l ?al??t???n? seditio severlere g?sterelim en az?ndan kaan ge?erli yamay? koyana dek sitelerinizi g?vende tutun
users.php?s=' sitenizin sonuna bu ?ekilde enterleyin sql hatas? verecektir, asl?nda bu a??k bir?ok exploit sitesinde yay?nland? ancak tam olarak kullan?m? a??klanmad? sadece Blind injection denilip ge?ildi pek dikkate al?nmad?, bu yolla sitenizin databasesine kolayl?kla ula?abiliyorlar, hay?rl? g?nler
Bu mesaj Kaan tarafından 2012-04-12 17:16 GMT, 5324 Gün önce düzenlendi.
Kaan - 2012-03-07 22:24 GMT -
?lgili Dosya Seditio SQL injection Yamas? Blind SQL Injection
system/core/users/users.inc.php yi a??n alttakini bulun.
Alttakiyle de?i?tirin.
Bu yama ge?ici olarak haz?rlanm??t?r Durumu Oliver'e bildirdim yak?n zamanda Ger?ek yamay? haz?rlayacakm??.
Bu yama ilede her hangi bir sorun ya?amazs?n?z.
son mesaj 9 dakika ?nce
Blind SQL Injection Nas?l Yap?l?r: http://resources.infosecinstitut.....njection/
Bu mesaj Kaan tarafından 2012-03-07 22:34 GMT, 5360 Gün önce düzenlendi.
?lgili Dosya Seditio SQL injection Yamas? Blind SQL Injection
system/core/users/users.inc.php yi a??n alttakini bulun.
Kod:
if ($f=='search' && mb_strlen($y)>1)
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_$s $w
LIMIT $d,".$cfg['maxusersperpage']);
}
elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
}
elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); }
}
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_$s $w
LIMIT $d,".$cfg['maxusersperpage']);
}
elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
}
elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_$s $w LIMIT $d,".$cfg['maxusersperpage']); }
}
Alttakiyle de?i?tirin.
Kod:
if ($f=='search' && mb_strlen($y)>1)
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_".$s." $w
LIMIT $d,".$cfg['maxusersperpage']);
}
elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
}
elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); }
}
{
$sq = $y;
$title .= $cfg['separator']." ". $L['Search']." '".sed_cc($y)."'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '%".sed_sql_prep($y)."%' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($g>1)
{
$title .= $cfg['separator']." ".$L['Maingroup']." = ".sed_build_group($g);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_maingrp='$g'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_maingrp='$g' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($gm>1)
{
$title .= $cfg['separator']." ".$L['Group']." = ".sed_build_group($gm);
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT u.* FROM $db_users as u
LEFT JOIN $db_groups_users as g ON g.gru_userid=u.user_id
WHERE g.gru_groupid='$gm'
ORDER BY user_".$s." $w
LIMIT $d,".$cfg['maxusersperpage']);
}
elseif (mb_strlen($f)==1)
{
if ($f=="_")
{
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '%'";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\")");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name NOT REGEXP(\"^[a-zA-Z]\") ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
else
{
$f = strtoupper($f);
$title .= $cfg['separator']." ".$L['use_byfirstletter']." '".$f."'";
$i = $f."%";
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_name LIKE '$i'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_name LIKE '$i' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
}
elseif (substr($f, 0, 8)=='country_')
{
$cn = strtolower(substr($f, 8, 2));
$title .= $cfg['separator']." ".$L['Country']." '";
$title .= ($cn=='00') ? $L['None']."'": $sed_countries[$cn]."'";
$cn_code = ($cn=='00') ? '' : $cn;
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE user_country='$cn_code'");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
$sql = sed_sql_query("SELECT * FROM $db_users WHERE user_country='$cn_code' ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']);
}
elseif ($f=='all')
{
$sql = sed_sql_query("SELECT COUNT(*) FROM $db_users WHERE 1");
$totalusers = sed_sql_result($sql, 0, "COUNT(*)");
if ($s=='maingrp')
{ $sql = sed_sql_query("SELECT u.* FROM $db_users as u LEFT JOIN $db_groups as g ON g.grp_id=u.user_maingrp ORDER BY grp_level $w LIMIT $d,".$cfg['maxusersperpage']); }
else
{ $sql = sed_sql_query("SELECT * FROM $db_users WHERE 1 ORDER BY user_".$s." $w LIMIT $d,".$cfg['maxusersperpage']); }
}
Bu yama ge?ici olarak haz?rlanm??t?r Durumu Oliver'e bildirdim yak?n zamanda Ger?ek yamay? haz?rlayacakm??.
Bu yama ilede her hangi bir sorun ya?amazs?n?z.
son mesaj 9 dakika ?nce
Blind SQL Injection Nas?l Yap?l?r: http://resources.infosecinstitut.....njection/
Bu mesaj Kaan tarafından 2012-03-07 22:34 GMT, 5360 Gün önce düzenlendi.