研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". : m$ }8 O* h2 P5 w' x; k" ^" p e5 \* } ' W6 _; U! ?- O# U6 B: q" t2 TAllwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. , j' `4 v8 W$ q+ M DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 2 p+ ~- {6 o4 a0 B# P% s$ jExploit: E-mail: <?php echo <p>Hello World</p> Homepage: <script language=javascript>alert ("Messagebox") 6 N1 A9 ]7 Q7 N# tComments: <IFRAME SRC=www.computerknights.org> : m: b4 S2 h6 J( D 4 M; |1 I& A: \5 X v Additional informationThe information has been provided by BliZZard.