研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". ( ^, A' Q6 b5 @2 y * @( }1 q c7 b3 J7 v: J2 |Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. 8 b1 h* F2 s: V- ^0 D DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". Exploit: E-mail: <?php echo <p>Hello World</p> * Q {0 l2 l6 |" Z9 |- j2 S- K: B- eHomepage: <script language=javascript>alert ("Messagebox") 7 a' G! z# L4 u, f3 G! g8 c8 [9 MComments: <IFRAME SRC=www.computerknights.org> 1 ^ B; P* s K/ m4 f* U+ } ' D) A X4 M5 ^* a Additional informationThe information has been provided by BliZZard.