当前位置 :| 主页>数据库>

利用SQL注入缺陷进行攻击的方法及代码

来源：黑客基地 作者： 时间：2007-03-02 点击：

　　SQL的Members_List、Your_Account模块中存在注入缺陷。如果magic_quotes_gpc选项为“OFF”，攻击者使用下列攻击方法及代码能利用该缺陷：

　　PHP代码/位置：

?/modules/Members_List/index.php :
------------------------------------------------------------------------
[...]
$count = "SELECT COUNT(uid) AS total FROM ".$user_prefix."_users ";
$select = "select uid, name, uname, femail, url from
".$user_prefix."_users ";
$where = "where uname != Anonymous ";

if ( ( $letter != "Other" ) AND ( $letter != "All" ) ) {
$where .= "AND uname like ".$letter."% ";

} else if ( ( $letter == "Other" ) AND ( $letter != "All" ) ) {
$where .= "AND uname REGEXP \"^\[1-9]\" ";

} else {
$where .= "";
}
$sort = "order by $sortby";
$limit = " ASC LIMIT ".$min.", ".$max;

$count_result = sql_query($count.$where, $dbi);
$num_rows_per_order = mysql_result($count_result,0,0);

$result = sql_query($select.$where.$sort.$limit, $dbi) or die();

echo " ";
if ( $letter != "front" ) {
echo "<table width=\"100%\" border=\"0\"
cellspacing=\"1\"><tr>\n";
echo "<td BGCOLOR=\"$bgcolor4\" align=\"center\">"._NICKNAME."</td>\n";
echo "<td BGCOLOR=\"$bgcolor4\" align=\"center\">"._REALNAME."</td>\n";
echo "<td BGCOLOR=\"$bgcolor4\" align=\"center\">"._EMAIL."</td>\n";
echo "<td BGCOLOR=\"$bgcolor4\" align=\"center\">"._URL."</td>\n";
$cols = 4;
[...]
------------------------------------------------------------------------

/modules/Your_Account/index.php :
switch($op) {
[...]
case "mailpasswd":
mail_password($uname, $code);
break;

case "userinfo":
userinfo($uname, $bypass, $hid, $url);
break;

case "login":
login($uname, $pass);
break;
[...]
case "saveuser":
saveuser($uid, $realname, $uname, $email, $femail, $url, $pass, $vpass,
$bio, $user_avatar, $user_icq, $user_occ, $user_from, $user_intrest,
$user_sig, $user_aim, $user_yim, $user_msnm, $attach, $newsletter);
break;
[...]
case "savehome":
savehome($uid, $uname, $storynum, $ublockon, $ublock, $broadcast,
$popmeson);
break;

case "savetheme":
savetheme($uid, $theme);
break;
[...]
case "savecomm":
savecomm($uid, $uname, $umode, $uorder, $thold, $noscore, $commentmax);
break;
[...]
}
------------------------------------------------------------------------

/modules/Your_Account/index.php :
[...]
function saveuser($uid, $realname, $uname, $email, $femail, $url, $pass,
$vpass, $bio, $user_avatar, $user_icq, $user_occ, $user_from, $user_intrest,
$user_sig, $user_aim, $user_yim, $user_msnm, $attach, $newsletter) {
global $user, $Ｃookie, $userinfo, $EditedMessage, $user_prefix, $dbi,
$module_name;
Ｃookiedecode($user);
$check = $Ｃookie[1];
$check2 = $Ｃookie[2];
$result = sql_query("select uid, pass from ".$user_prefix."_users where
uname=$check", $dbi);
list($vuid, $ccpass) = sql_fetch_row($result, $dbi);
if (($uid == $vuid) AND ($check2 == $ccpass)) {
if (!eregi("http://";, $url)) {
$url = "http://$url";
}
if ((isset($pass)) && ("$pass" != "$vpass")) {
echo "<center>"._PASSDIFFERENT."</center>";
} elseif (($pass != "") && (strlen($pass) < $minpass)) {
echo "<center>"._YOUPASSMUSTBE." $minpass
"._CHARLONG."</center>";
} else {
if ($bio) { filter_text($bio); $bio = $EditedMessage; $bio =
FixQuotes($bio); }
if ($pass != "") {
Ｃookiedecode($user);
sql_query("LOCK TABLES ".$user_prefix."_users WRITE", $dbi);
$pass = md5($pass);
sql_query("update ".$user_prefix."_users set name=$realname,
email=$email, femail=$femail, url=$url, pass=$pass, bio=$bio ,
user_avatar=$user_avatar, user_icq=$user_icq, user_occ=$user_occ,
user_from=$user_from, user_intrest=$user_intrest, user_sig=$user_sig,
user_aim=$user_aim, user_yim=$user_yim, user_msnm=$user_msnm,
newsletter=$newsletter where uid=$uid", $dbi);
$result = sql_query("select uid, uname, pass, storynum, umode, uorder,
thold, noscore, ublockon, theme from ".$user_prefix."_users where
uname=$uname and pass=$pass", $dbi);
if(sql_num_rows($result, $dbi)==1) {
$userinfo = sql_fetch_array($result, $dbi);

doＣookie($userinfo[uid],$userinfo[uname],$userinfo[pass],$userinfo[storynum],
$userinfo[umode],$userinfo[uorder],$userinfo[thold],$userinfo[noscore],$userinfo[ublockon],
$userinfo[theme],$userinfo[commentmax]);
} else {
echo "<center>"._SOMETHINGWRONG."</center> ";
}

[收藏] [推荐] [评论] [打印] [关闭]

顶一下

上一篇：保护 SQL Server 数据库的十大绝招
下一篇：有孔就入 SQL Injection的深入探讨

最新评论共有 0 位网友发表了评论

查看所有评论

发表评论

栏目列表