研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". 2 B# D1 }& ?; ~; k$ ~6 L8 [6 X " D. V9 L2 L: S) h& I9 T7 O$ ?Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. B8 I' ]- M+ a/ i1 K/ Y$ B) A DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". + u v. L* M6 l' w4 [Exploit: E-mail: <?php echo <p>Hello World</p> Homepage: <script language=javascript>alert ("Messagebox") 9 ~& g$ f8 m; @9 ^$ LComments: <IFRAME SRC=www.computerknights.org> + R( X+ ]+ q1 b M' O+ n& _ Additional informationThe information has been provided by BliZZard.