研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". 7 @- Z( Y9 M1 w- G0 H4 | Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. : A& W7 P4 r/ Q) w- U 2 O% z9 {4 K7 x% X0 P3 M' \ DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 7 T3 O& q/ \& R8 {Exploit: 3 q% T3 O0 n2 V3 u' z' uE-mail: <?php echo <p>Hello World</p> , m: F: V4 q5 V8 M0 AHomepage: <script language=javascript>alert ("Messagebox") ( K# r3 x* J! C! xComments: <IFRAME SRC=www.computerknights.org> & b) |5 r3 L$ r2 C* M. y Additional informationThe information has been provided by BliZZard.