研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". 1 \ F& F$ ?5 y. m' \1 oAllwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. . {& Q5 n4 O7 f* g! ~2 f0 _ DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". ; c2 y9 }7 ^0 D Exploit: E-mail: <?php echo <p>Hello World</p> 8 m# C- g4 A; @5 Y7 WHomepage: <script language=javascript>alert ("Messagebox") & {* d' K7 S8 mComments: <IFRAME SRC=www.computerknights.org> * c* _* x0 h0 ?5 ^* Z 0 o8 f2 N* W# L& v6 d; G- } Additional informationThe information has been provided by BliZZard.