e107 0.7.20 Usersettings页面SQL注入漏洞
1. 访问有漏洞的e107
2. 创建名为xpltest的新用户
3. 以xpltest身份登录
4. 进入到用户设置
5. 在页面的HTML源码中从隐藏的_uid字段找到用户ID，假设为444。
6. 将xpltest'/*输入到realname字段
7. 将*/,user_admin=1 where user_id=444 -- x输入到签名字段（用自己的用户ID替换444）
8. 启动tamperdata开始激活篡改
9. 提交用户设置并将realname变量更改为loginname
10. 现在xpltest用户为管理员
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
18 May 2010 00:00Current
7High risk
Vulners AI Score7