Grand phpcmsv9 burst pipe processing password vulnerability-vulnerability warning-the black bar safety net

2012-09-16T00:00:00
ID MYHACK58:62201234929
Type myhack58
Reporter 佚名
Modified 2012-09-16T00:00:00

Description

Vulnerability type: SQL injection vulnerability

Hazard rating: high

The self-assessment Rank: 1 to 5

Vulnerability status: the vulnerability has notified the manufacturer but the manufacturer ignored the vulnerability

Brief description:

Grand phpcmsv9 squib processing the password vulnerability of large cattle ' Mo laughing at you earlier have gone through. To the small black people look at Oh and...

Detailed description:

Vulnerability formed reasons will not say more 文件 在 phpcms/api.php interested basin friends can go dig a dig phpcms the 洞子 The main use of the process: The first step: to register a user http://www.89school.com/index.php?m=member&c=index&a=register&siteid=1 Second step: access the api file, broke the table prefix the default table prefix for v9 The third step: into the background, get the shell is not much to say.

Vulnerability proof:

The first step: to register a user http://www.89school.com/index.php?m=member&c=index&a=register&siteid=1 Second step: access the api file, broke the table prefix the default table prefix for v9

Repair solutions:

The Grand engineers to understand.