------------------------------------------

# Xoops 2.5.4 Blind SQL Injection

------------------------------------------

下载地址: http://sourceforge.net/projects/xoops/

作者: blkhtc0rp www.2cto.com  blkhtc0rp[at]yahoo[dot]com

测试平台: Freebsd 8 and Debian Squeeze

注释:

In order to be successful an attacker must have permission to access the administration menu.

测试示例:

http://www.2cto.com /xoops-2.5.4/modules/system/admin.php?fct=users&selgroups=[Blind Sqli]

www.2cto.com提供修复：

过滤admin.php页面参数输入