标题: url shortener script 1.0 sql injection Vulnerabilities

作者: M.Jock3R www.2cto.com

开发官方: http://djpate.com/

下载地址: http://www.phpkode.com/scripts/item/url-shortener-script/

测试平台: windows XP Sp2 FR

 

===================================================================================

缺陷文件: show.php

 

缺陷代码分析:

 

    if($_GET['id']){

        require("mysql.php");

        $id = addslashes($_GET['id']);

        $getUrl = mysql_query("select url from urls where id = $id");

        

示例:

 

http://www.2cto.com /url-shortener-script/show.php?id=[Inj3ct]

 

===================================================================================

修复：过滤该页面输入

 

Greets To :

adelsbm / attiadona  / Wjunction forum

---------------------------------

I Love you Mindy

---------------------------------

Email : madrido.jocker@gmail.com

 

THANKS TO ALL ALGERIANS HACK3RS