研究生数学建模竞赛开始报名了！！

韩冰

SummaryMySQLguest by "Allwebscripts is a guestbook script that uses MySQL to store messages". # m, ~( }+ f2 w8 QAllwebscripts' MySQLguest is vulnerable to a source code injection vulnerability in the AWSguest.php page. The vulnerability occurs as fields in the AWSguest.php page do not adequately sanitize HTML, script or PHP code. + k( P9 M, j1 R1 J7 V DetailsIn the AWSguest.php page, any of the following fields can be used to inject arbitrary HTML, JavaScript or PHP: "Name", "Email", "Homepage" and "Comments". 4 K0 H( t3 z9 U8 n- m5 HExploit: E-mail: <?php echo <p>Hello World</p> 3 B* |( Q- ?0 a9 j# B* W+ NHomepage: <script language=javascript>alert ("Messagebox") Comments: <IFRAME SRC=www.computerknights.org> Additional informationThe information has been provided by BliZZard.