有两处SQL注入 分别是： http://bbs.daqi.com/cgi-bin/bbs/author.cgi?author=test' http://try.daqi.com/cgi-bin/experience/exp_active_email?key=test&uid=test' xmysql::query() error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ''test'' limit 1' at line 1 - select jparticle.id_jparticle,jparticle.id_jpdir,jparticle.id_article,jparticle.title,jparticle.url,jparticle.id_bbs,jparticle.bbsname,jparticle.postdate,jparticle.click,jparticle.replycount,jparticle.dirno,jparticle.author,jparticle.level,jparticle.weight,jparticle.weight_score,jparticle.state,jparticle.notelevel,jparticle.id_site,jparticle.sitename,jparticle.msgno from jparticle where author='test'' limit 1 www.2cto.com xmysql::query() error: Unknown column 'test' in 'where clause' - select count(*) from exp_user where id=test and active_state=0 and v_key='test' 漏洞 证明： http://bbs.daqi.com/cgi-bin/bbs/author.cgi?author=test' http://try.daqi.com/cgi-bin/experience/exp_active_email?key=test&uid=test' 修复方案： 过滤参数 作者 zhk
查看更多关于大旗网论坛和精品体验子站SQL注入 - 网站安全的详细内容...