A bloody case caused by database explosion

Www.2cto.com: Suitable for new users

Today, I was bored. I scanned my website in batches and found a website with a library burst vulnerability.

 

I downloaded the database viewer with curiosity.

It is found that the whole site database of the website,

 

Open the http://www.cmd5.com/saw the password turned out to be 111111 --

It is not good for administrators who can make the website suffer from database explosion.

 

Scanned the background of the website and successfully logged in,

Decisively, you can see that the website has a database backup, which makes it easy to directly change the asp Suffix of the Trojan to jpg and then upload it through the image method,

Then back up the jpg file as asp,

Then the following is simple.

Open the backup path and enter the asp Trojan password.

<Script> </script>