研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". ' H, R8 `& ^. V5 N' Q Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. 6 s( R; \ _1 i8 z DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 6 @6 b9 H$ m+ f/ q2 Q1 Y+ f ' n& H# u0 d# @9 {Exploit: E-mail: <?php echo <p>Hello World</p> Homepage: <script language=javascript>alert ("Messagebox") Comments: <IFRAME SRC=www.computerknights.org> 3 {2 n% V, M. x: W ) f4 N3 n: y/ L9 T! F5 Z9 q Additional informationThe information has been provided by BliZZard.