研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. 4 N; `8 P' ]' d6 `- _6 ] DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 0 y0 ^3 Y4 q5 K/ K$ O- X% ~6 qExploit: * r+ H: g% c0 e) e4 }: a: q& uE-mail: <?php echo <p>Hello World</p> Homepage: <script language=javascript>alert ("Messagebox") 7 D" X* s) _) e1 rComments: <IFRAME SRC=www.computerknights.org> 0 p% B8 R% G- c, a' e2 i, t Additional informationThe information has been provided by BliZZard.