某通用型建站系统SQL注射之四

2015-03-24T00:00:00
ID SSV:95624
Type seebug
Reporter Root
Modified 2015-03-24T00:00:00

Description

简要描述:

某通用型建站系统SQL注射之四

详细说明:

某通用型建站系统SQL注射之四。 源码:XYCMS教育培训机构网站源码 v5.1 http://down.chinaz.com/soft/30486.htm 注入点:dir_url.asp?id= 可谷歌搜索:inurl:dir_url.asp?id=

<img src="https://images.seebug.org/upload/201503/231633261da19e6ff4279c8cd48bf40ae0a81181.png" alt="QQ图片20150323163032.png" width="600" onerror="javascript:errimg(this);">

实例证明: http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.zhusiarts.com/dir_url.asp?id=21 http://www.jd19s.com/dir_url.asp?id=23 http://www.jmxjjb.com/dir_url.asp?id=2 http://www.szakpx.com/dir_url.asp?id=22 http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.fjzzedu.com/dir_url.asp?id=21 http://www.hbxwedu.cn/dir_url.asp?id=21

漏洞证明:

实例+注入证明: http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.zhusiarts.com/dir_url.asp?id=21 http://www.jd19s.com/dir_url.asp?id=23 http://www.jmxjjb.com/dir_url.asp?id=2 http://www.szakpx.com/dir_url.asp?id=22 http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.fjzzedu.com/dir_url.asp?id=21 http://www.hbxwedu.cn/dir_url.asp?id=21

<img src="https://images.seebug.org/upload/201503/231634143eb4c83311cefb78b4daebb21eafc102.png" alt="QQ图片20150323163100.png" width="600" onerror="javascript:errimg(this);">