研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". * d7 m6 N) D' p5 ]( y9 m Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. 7 E* ? ?" S/ c$ ]$ d$ a$ s5 R DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 0 Y, A) p( j- \5 c" wExploit: 4 d3 `! q; w. rE-mail: <?php echo <p>Hello World</p> Homepage: <script language=javascript>alert ("Messagebox") Comments: <IFRAME SRC=www.computerknights.org> m" x, I% p( f) z* t" S Additional informationThe information has been provided by BliZZard.