Vulnerability packaging on a site in Sohu focal point (background permission leakage, injection, etc)

Vulnerability packaging on a site in Sohu focal point (background permission leakage, injection, etc)

1. permission settings:

Directly access an application in the background: Switch the ip address to the review (I didn't know what it was about ..)

Http://ncfile.focus.cn/common/modules/bbsadm/trans_domain_app.php? Page = 499 & app = 1

2. Source Code Leakage

Http://ncfile.focus.cn/common/modules/dmc/adm/rdistnsPYpl

Http://ncfile.focus.cn/common/modules/dmc/votehouse_view.left.inc

Http://ncfile.focus.cn/common/dao/dao.tpl.php

3. The exposed physical path is not deleted on the test page.

Http://ncfile.focus.cn/common/admin/test.php

 

4,Injection. Union is supported. There are physical paths. You can check the user table. It seems that you can export the file to the shell, but it does not succeed. It seems that there is a filter...

The above ip address is switched to reviewSystem:

Http://ncfile.focus.cn/common/modules/bbsadm/trans_domain_app.php? Page = 499 & app = 1% 20and % 201 = 2% 20 union % 20 select %,-+

Vulnerability packaging on a site in Sohu focal point (background permission leakage, injection, etc)