magic_quotes_gpc = Off的phpkit能够通过注入取得管理员的MD5密码.
/phpkit/include.php?path=login/member.php&letter=phuket' AND MID(user_pw,1,1)='8'/*
猜解密码这种事情太烦了,用delphi写了个程式帮忙,太久不写程式,差点连语法都不会了.惨....
SQL Injection and PHP Code Injection Vulnerabilities in PHPKit 1.6.1
Version: PHPKit 1.6.1
Risk: High if magic_quotes_gpc = Off
URL: http://www.phpkit.com
***************************************************************************
SQL Injection in include.php?path=login/member.php
The parameters usernick and letters are vulnerable to SQL Injections.
POC:
/phpkit/include.php?path=login/member.php&letter=phuket' AND MID(user_pw,1,1)='8'/*
This will show the user "phuket" if the first character of his password
hash is '8'.
SQL Injection in include.php?path=login/imcenter.php
The parameter im_receiver is vulnerable to SQL Injections.
POC: im_receiver=phuket' AND MID(user_pw,1,1)='8'/*
This will print an error message like "Der von Ihnen angegebene
Empf鋘ger konnte nicht gefunden werden. 躡erpr黤en Sie bitte Ihre Eingabe!"
If the first character of the password hash is not '8'.
PHP Code Injection in admin/admin.php?path=images.php
It is possible to upload .php files to the content/images/ directory.
Of course you need a legal admin pass first.
Exploit code exists but I will not make it available to the public at
this time.
*******************************************************************************
Solution:
Turn magic_quotes on
Phuket
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
