IT技术互动交流平台

友情检测大旗网论坛及精品体验子站SQL注入漏洞

发布日期:2012-06-08 19:56:32

有两处SQL注入
分别是:
http://bbs.daqi.com/cgi-bin/bbs/author.cgi?author=test'
http://try.daqi.com/cgi-bin/experience/exp_active_email?key=test&uid=test'
 
 
xmysql::query() error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ''test'' limit 1' at line 1 - select jparticle.id_jparticle,jparticle.id_jpdir,jparticle.id_article,jparticle.title,jparticle.url,jparticle.id_bbs,jparticle.bbsname,jparticle.postdate,jparticle.click,jparticle.replycount,jparticle.dirno,jparticle.author,jparticle.level,jparticle.weight,jparticle.weight_score,jparticle.state,jparticle.notelevel,jparticle.id_site,jparticle.sitename,jparticle.msgno from jparticle where author='test'' limit 1 www.it165.net
 
 
xmysql::query() error: Unknown column 'test' in 'where clause' - select count(*) from exp_user where id=test and active_state=0 and v_key='test'
漏洞证明:

http://bbs.daqi.com/cgi-bin/bbs/author.cgi?author=test'
http://try.daqi.com/cgi-bin/experience/exp_active_email?key=test&uid=test'
修复方案:

过滤参数

作者 zhk

Tag标签: SQL注入漏洞  
  • 专题推荐

About IT165 - 广告服务 - 隐私声明 - 版权申明 - 免责条款 - 网站地图 - 网友投稿 - 联系方式
本站内容来自于互联网,仅供用于网络技术学习,学习中请遵循相关法律法规