Lucene search
K

嘉缘人才系统1处SQL注入#6(demo测试)

🗓️ 27 Nov 2014 00:00:00Reported by RootType 
seebug
 seebug
🔗 www.seebug.org👁 48 Views

嘉缘人才系统1处SQL注入#6(demo测试). SQL注入在http://v2014.rccms.com/member/index.php?m=person_interview&show=works这个页面,删除面试通知处。$checks去了$_POST['checks'],然后带入了SQL,没有做有效性检查。貌似可以注入。准备:先一个个人账号,个人账号添加一份简历。注册一个公司账号,公司账号添加一个职位,然后发送面试邀请给刚才的简历。或者添加个人简历后,等待系统自动推荐一些简历过来。进入会员中心 > 求职管理 > 收到的面试通知, 可以看到刚才的面试通知。还是老样子,先修改HTML做个简单的测

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation