研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". + X: o0 @) D8 e& U% ~ ' N0 X- g) h, N% D- @+ h4 ]* j" E) EAllwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. - c' x1 s- L/ c" { DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". Exploit: E-mail: <?php echo <p>Hello World</p> & t. e$ w& Z E1 GHomepage: <script language=javascript>alert ("Messagebox") Comments: <IFRAME SRC=www.computerknights.org> ) M6 \+ E/ e% i+ G7 `! `# \ ; @4 p( x9 d7 p8 J/ `) y% F2 | Additional informationThe information has been provided by BliZZard.