|
070-8260-2526
ÆòÀÏ ¿ÀÀü 9½Ã ~ ¿ÀÈÄ 6½Ã
´ÜÀ§³óÇù
352-0331-1626-83
¿¹±ÝÁÖ:°¸¸¼öÅ×Å©³ÝÄÚ¸®¾Æ
|
ÀÚÁÖ¹¯´Â Áú¹® |
Ȩ > °í°´¼¾ÅÍ > ÀÚÁÖ¹¯´Â Áú¹®
|
Á¶È¸¼ö
|
6507
|
Áú¹®
|
SQL Injection ´çÇÑ DB ÀÇ ½ºÅ©¸³Æ® »èÁ¦ Äõ¸®
|
DECLARE @T varchar(255), @C varchar(255);
DECLARE Table_Cursor CURSOR FOR
SELECT a.name, b.name
FROM sysobjects a, syscolumns b
WHERE a.id = b.id AND a.xtype = 'u' AND
(b.xtype = 99 OR
b.xtype = 35 OR
b.xtype = 231 OR
b.xtype = 167);
OPEN Table_Cursor;
FETCH NEXT FROM Table_Cursor INTO @T, @C;
WHILE (@@FETCH_STATUS = 0) BEGIN
EXEC(
'update ['+@T+'] set ['+@C+'] = left(
convert(varchar(8000), ['+@C+']),
len(convert(varchar(8000), ['+@C+'])) - 6 -
patindex(''%tpircs<%'',
reverse(convert(varchar(8000), ['+@C+'])))
)
where ['+@C+'] like ''%<script%</script>'''
);
FETCH NEXT FROM Table_Cursor INTO @T, @C;
END;
CLOSE Table_Cursor;
DEALLOCATE Table_Cursor;
|
|
|
|
|