inl ulog-php prior 0.8.2 port.php sql injection.plugin

来自「全面网络扫描器VB源代码 很实用」· PLUGIN 代码 · 共 48 行

<plugin_id>181</plugin_id>
<plugin_name>INL ulog-php prior 0.8.2 port.php SQL Injection</plugin_name>
<plugin_family>CGI</plugin_family>
<plugin_created_date>2004/09/08</plugin_created_date>
<plugin_created_name>Marc Ruef</plugin_created_name>
<plugin_created_email>marc dot ruef at computec dot ch</plugin_created_email>
<plugin_created_web>http://www.computec.ch</plugin_created_web>
<plugin_created_company>computec.ch</plugin_created_company>
<plugin_updated_name>Marc Ruef</plugin_updated_name>
<plugin_updated_email>marc dot ruef at computec dot ch</plugin_updated_email>
<plugin_updated_web>http://www.computec.ch</plugin_updated_web>
<plugin_updated_company>computec.ch</plugin_updated_company>
<plugin_updated_date>2004/11/14</plugin_updated_date>
<plugin_version>2.0</plugin_version>
<plugin_changelog>Corrected the plugin structure and added the accuracy values in 1.1. Improved the pattern matching and introduced the plugin changelog in 2.0</plugin_changelog>
<plugin_protocol>tcp</plugin_protocol>
<plugin_port>80</plugin_port>
<plugin_procedure_exploit>open|send GET /port.php?proto=tcp' HTTP/1.0\n\n|sleep|close|pattern_exists HTTP/#.# ### *select ip_saddr,ip_daddr,ip_protocol,oob_time_sec,tcp_sport,tcp_dport,udp_sport,udp_dport,oob_prefix,id*</plugin_procedure_exploit>
<plugin_exploit_accuracy>95</plugin_exploit_accuracy>
<plugin_comment>This plugin was written with the ATK Attack Editor and inspired by the Nessus plugin.</plugin_comment>
<bug_published_email>info at inl dot fr</bug_published_email>
<bug_published_web>http://www.inl.fr</bug_published_web>
<bug_published_company>INL</bug_published_company>
<bug_published_date>2004/08/23</bug_published_date>
<bug_advisory>http://www.inl.fr/rubrique.php3?id_rubrique=11</bug_advisory>
<bug_affected>INL ulog-php prior 0.8.2</bug_affected>
<bug_not_affected>INL ulog-php newer than 0.8.2 or other solutions</bug_not_affected>
<bug_vulnerability_class>SQL Injection</bug_vulnerability_class>
<bug_description>The remote host is running ulog-php, a firewall log analysis interfacewritten in PHP. There is a bug in port.php which may allow an attacker to force it to execute arbitrary SQL statements on the remote host. An attacker may use this flaw to gain the control of the remote website and possibly execute arbitrary commands on the remote host.</bug_description>
<bug_solution>Disable this suite or upgrade to the latest version and limit unwanted connections and communications with firewalling. Change the default directory of the application to make automated scans harder.</bug_solution>
<bug_fixing_time>Approx. 30 minutes</bug_fixing_time>
<bug_exploit_availability>Yes</bug_exploit_availability>
<bug_exploit_url>http://www.securityfocus.com/bid/11018/exploit/</bug_exploit_url>
<bug_remote>Yes</bug_remote>
<bug_local>Yes</bug_local>
<bug_severity>High</bug_severity>
<bug_popularity>6</bug_popularity>
<bug_simplicity>7</bug_simplicity>
<bug_impact>8</bug_impact>
<bug_risk>7</bug_risk>
<bug_nessus_risk>High</bug_nessus_risk>
<bug_check_tool>Nessus is able to do the same check.</bug_check_tool>
<source_securityfocus_bid>11018</source_securityfocus_bid>
<source_nessus_id>14363</source_nessus_id>
<source_literature>Hacking Exposed: Network Security Secrets & Solutions, Stuart McClure, Joel Scambray and George Kurtz, February 25, 2003, 4th Edition, McGraw-Hill Osborne Media, ISBN 0072227427</source_literature>
<source_misc>http://www.computec.ch</source_misc>