研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". ; Z' I! k8 f* W" _/ @) I8 ]6 d8 |2 o 9 |" {. k* b/ t3 N% b, F& E( SAllwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 2 ]4 o: G6 Z ^/ R. \Exploit: E-mail: <?php echo <p>Hello World</p> # I8 b( K3 O- m, @5 uHomepage: <script language=javascript>alert ("Messagebox") ' F6 ]0 }, R8 y5 `( SComments: <IFRAME SRC=www.computerknights.org> Additional informationThe information has been provided by BliZZard.