========================[Author]============================
[+] Founded : ZhaoHuAn
[+] Contact : ZhengXing[at]shandagames[dot]com
[+] Blog : http://www.patching.net/zhaohuan/
[+] Date : August, 26th 2009 [Double Seventh Festival]
========================[Soft Info]=========================
Software: Discuz! Plugin Crazy Star(family)
Version : 2.0
Vendor : http://www.discuz.com
阅读全文 »
============================================================
Wordpress Plugin WP-Syntax <= 0.9.1 Remote Command Execution
============================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /’ \ __ /’__`\ /\ \__ /’__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /’ _ `\ \/\ \/_/_\_<_ /’___\ \ \/\ \ \ \ \/\`’__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1
阅读全文 »
插件名：2Fly礼品(序号)发放系统
漏洞文件：2fly_gift.php(只说最新版)
作者：CN.Tnik&Tojen(俺俩老乡)
代码分析：
主要是gameid参数没有过滤导致注入出现
1. output分支下的gameid
$query = $db->query("SELECT * FROM `{$tablepre}2fly_gift` WHERE `id` = $gameid LIMIT 1");
$game = $db->fetch_array($query);明显没有过滤，注入出现，但是由于没有数据显示位，导致注入返回的数据看不到，有点鸡肋
阅读全文 »
