EUVD-2009-3778

Malware in sbrugna...

CVE-2009-3806: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in feedbackjs.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter...

织梦(DEDECMS) 5.1 plus/feedback_js.php存在注入漏洞

在magicquotesgpc=off的情况下可用 此漏洞可拿到后台管理员的帐号和加密HASH,漏洞存在文件plus/feedbackjs.php,未过滤参数为$arcurl ...... $urlindex = 0; ifempty$arcID $row = $dlist-dsql-GetOne"Select id From @cachefeedbackurl where url='$arcurl' "; //此处$arcurl没有过滤 ifisarray$row $urlindex = $row'id';...