研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". 3 x4 r- K8 h) ]$ |. g) g Allwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. : ^! ~! q# q" I9 m. [' S& J* u DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". % q0 q9 @% g' Z9 U! y5 H- yExploit: # o9 |( d* J, Y/ ? {9 CE-mail: <?php echo <p>Hello World</p> Homepage: <script language=javascript>alert ("Messagebox") % \$ P' f" c4 MComments: <IFRAME SRC=www.computerknights.org> - X, o& x0 u" @4 |& D ( y5 C2 l1 V7 i# y T Additional informationThe information has been provided by BliZZard.