某通用型建站系统SQL注射之四

### 简要描述： 某通用型建站系统SQL注射之四 ### 详细说明： 某通用型建站系统SQL注射之四。 源码：XYCMS教育培训机构网站源码 v5.1 http://down.chinaz.com/soft/30486.htm 注入点：dir_url.asp?id= 可谷歌搜索：inurl:dir_url.asp?id= [<img src="https://images.seebug.org/upload/201503/231633261da19e6ff4279c8cd48bf40ae0a81181.png" alt="QQ图片20150323163032.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/231633261da19e6ff4279c8cd48bf40ae0a81181.png) 实例证明： http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.zhusiarts.com/dir_url.asp?id=21 http://www.jd19s.com/dir_url.asp?id=23 http://www.jmxjjb.com/dir_url.asp?id=2 http://www.szakpx.com/dir_url.asp?id=22 http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.fjzzedu.com/dir_url.asp?id=21 http://www.hbxwedu.cn/dir_url.asp?id=21 ### 漏洞证明： 实例+注入证明： http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.zhusiarts.com/dir_url.asp?id=21 http://www.jd19s.com/dir_url.asp?id=23 http://www.jmxjjb.com/dir_url.asp?id=2 http://www.szakpx.com/dir_url.asp?id=22 http://www.nbjbtsyey.com/dir_url.asp?id=12 http://www.fjzzedu.com/dir_url.asp?id=21 http://www.hbxwedu.cn/dir_url.asp?id=21 [<img src="https://images.seebug.org/upload/201503/231634143eb4c83311cefb78b4daebb21eafc102.png" alt="QQ图片20150323163100.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/231634143eb4c83311cefb78b4daebb21eafc102.png)